MCP Scanner is a free, open-source security tool that detects tool poisoning, prompt injection, rug pulls, and cross-origin escalation attacks in Model Context Protocol servers.
122
Detection Rules
15
Vulnerability Categories
10/10
OWASP MCP Coverage
MCP Scanner analyzes Model Context Protocol (MCP) servers for security vulnerabilities. MCP is the protocol that connects AI agents like Claude, ChatGPT, and Cursor to external tools and data sources. MCP Scanner checks these connections for tool poisoning attacks, prompt injection vulnerabilities, rug pull risks, and cross-origin privilege escalation. It maintains a public leaderboard ranking MCP servers by security score, helping developers choose safe integrations for their AI agent workflows.
[ Capabilities ]
Detect hidden instructions in tool descriptions that manipulate AI agents into performing unintended actions.
Find injection vulnerabilities in tool parameters, responses, and metadata that override AI agent behavior.
Track tool definition changes between scans with SHA-256 hashing. Detect post-approval behavior modifications.
Identify shadow MCP servers, proxy relays, and undocumented tool registrations expanding the attack surface.
Detect hardcoded API keys, tokens, and secrets across 15+ providers. Entropy-based detection for unknown patterns.
Paste your claude_desktop_config.json to find dangerous commands, non-HTTPS endpoints, and excessive permissions.
Start scanning in seconds. No account required.