Project Shield

Security scanner for MCP servers and AI-generated code.

One command to security-grade your MCP server.

Installation

npm install -g project-shield

Or use directly with npx:

npx project-shield scan .

Related MCP server: agent-audit

MCP Server Configuration

Add to your MCP client config:

{
  "mcpServers": {
    "project-shield": {
      "command": "npx",
      "args": ["-y", "project-shield", "scan", "."]
    }
  }
}

Tools

scan

Security scan a directory or MCP server project. Returns A-F grade with detailed findings.

Parameters:

• path (string, required) - Directory to scan

• format (string, optional) - Output format: text, json, badge

grade

Get the security grade for a project without full report.

evidence

Generate a tamper-proof Evidence Pack with SHA-256 hashed scan results.

What it detects

Security Grades

Features

• 275+ detection rules across 4 security layers

• A-F grading system with automatic deploy lock on F

• Evidence Packs - SHA-256 hashed, tamper-proof scan results

• Fix-it guides - actionable remediation for every finding

• Badge system - verifiable security badges for your projects

• MCP-native - scans MCP protocol-level security, not just code

Pricing

Links

• Website: shield.codemeant.dev

• npm: project-shield

• Product Hunt: Project Shield

License

MIT