Security directory
Tools for reviewing MCP source code, metadata, permissions, dependencies, protocol behavior, and live traffic. Capabilities are based on each project's published documentation.
Capability comparison
Compare which parts of the MCP security lifecycle each scanner covers. Optional analyzers may require additional services or API keys.
| Security tool | Source analysis | Tool metadata | Dependencies | Permissions & auth | Runtime traffic | Protocol fuzzing | Tool poisoning |
|---|---|---|---|---|---|---|---|
| MCPSafe Startup product | ● | ● | ◐ | ● | — | — | ● |
| Cisco MCP Scanner Open source | ◐ | ● | — | ◐ | ◐ | — | ● |
| Invariant MCP-Scan Open source | — | ● | — | ● | ● | — | ● |
| MCTS Open source | ● | ● | ◐ | ● | ● | ◐ | ● |
| MCP Security Scanner Open source | ● | ● | ● | ● | ● | ● | ● |
| mcpsec Open source | ● | ◐ | — | ◐ | ● | ● | ◐ |
| mcpaudit Open source | ● | ◐ | ◐ | ● | — | — | ◐ |
| mcp-audit Open source | ● | ● | ● | ● | ◐ | — | ● |
| Valtik MCP Security Scanner Open source | ● | ◐ | — | ◐ | — | — | ◐ |
| mcp-shield Open source | ● | ● | ● | ● | — | — | ● |
| mcp-scanner Open source | — | ● | — | ● | ● | — | ● |
| MCPRadar Open source | ● | ● | ● | ● | ● | ◐ | ● |
| MCPSafetyScanner Paper + code | ◆ | ◆ | — | ◆ | ◆ | — | ◆ |
| MCP-SandboxScan Research | — | ◆ | — | ◆ | ◆ | — | ◆ |
| MCPTox Benchmark | — | ◆ | — | — | ◆ | — | ◆ |
Coverage reflects publicly documented capabilities and is not an independent certification.
A hosted scanner that accepts a package name, GitHub URL, or registry identifier and returns a security report.
Scans MCP tools, prompts, and resources using customizable YARA rules, LLM-as-judge, and optional Cisco AI Defense inspection.
Discovers configured MCP servers, checks tool descriptions, and can proxy live MCP traffic to enforce security policies.
A local-first threat scanner for MCP repositories and running servers, with auditable scores and CI-friendly output.
A TypeScript security toolkit spanning source, configuration, dependencies, authentication, transport, and runtime behavior.
A dynamic MCP protocol fuzzer and source auditor designed to demonstrate whether suspicious behavior is exploitable at runtime.
A lightweight scanner for reviewing JavaScript and TypeScript MCP servers before connecting them to an agent.
Audits MCP configurations, exposed capabilities, authentication, transports, and risky launch patterns before an agent connects.
A zero-setup static scanner for JavaScript, TypeScript, and Python MCP server source code.
Scans local projects and npm MCP packages for injection, secrets, dependency, permission, and supply-chain risks.
Discovers MCP servers configured across popular clients, scans their protocol surface, and can proxy live calls.
Combines MCP enumeration, source and dependency analysis, configuration review, sandboxed execution, and behavioral snapshots.
A multi-agent auditor that explores configured server capabilities and produces risks and mitigation advice.
Executes untrusted tools in a WebAssembly/WASI sandbox and records runtime evidence of data exposure and filesystem capability violations.
Read the paper ↗Measures whether MCP-enabled agents follow malicious instructions hidden in tool descriptions across real-world servers.
Read the paper ↗Important: A clean scan is not proof that an MCP server is safe. Combine source review, metadata scanning, dependency checks, sandboxed runtime testing, and human verification.
