Repolode
Submit
cisco-ai-defense

cisco-ai-defense/mcp-scanner

A Python tool from Cisco that scans MCP servers, tools, prompts and source code for security threats using YARA rules, LLM analysis and Cisco AI Defense.

View on GitHubWebsite
Stars
1,094
Forks
148
Open issues
74
Last commit
4 days ago

What is it?

MCP Scanner checks Model Context Protocol servers and their tools for potential malicious behavior and security findings. It can scan tools, prompts, resources and server instructions from remote servers (SSE or streamable HTTP), local stdio servers, or pre-generated JSON files for offline use in CI/CD pipelines.

The scanner combines three engines: YARA rules, LLM-based analysis, and the Cisco AI Defense inspect API. They can be run together or independently. Additional modules cover behavioral analysis of MCP server source code, VirusTotal hash lookups for bundled binaries, Python dependency vulnerability checks via pip-audit, and sandboxed scanning of PyPI and npm packages.

It is available as a CLI (mcp-scanner), a REST API server (mcp-scanner-api), and a Python SDK. Output can be formatted as summary, detailed, table, severity-grouped or raw JSON.

Key features

  • 01Scans MCP tools, prompts, resources and server instructions for security findings.
  • 02Combines YARA rules, LLM-based analysis and Cisco AI Defense inspect API, usable together or separately.
  • 03Connects to remote (SSE, streamable HTTP) and stdio MCP servers, or reads static JSON files offline.
  • 04Includes behavioral source-code analysis across ten programming languages.
  • 05Checks Python dependencies for known CVE, PYSEC and GHSA vulnerabilities with pip-audit.
  • 06Provides CLI, REST API and Python SDK interfaces.

Use cases

  • Vetting third-party MCP servers before connecting them to an AI agent.
  • Adding offline MCP tool-definition checks to a CI/CD pipeline without API keys.
  • Scanning PyPI or npm packages that provide MCP servers before installing them.
  • Auditing MCP client configuration files already present on a developer machine.

Quick start

  1. 1

    Install the CLI tool with uv

    uv tool install --python 3.13 cisco-ai-mcp-scanner
  2. 2

    Run a YARA scan of a stdio MCP server

    mcp-scanner --stdio-command uvx --stdio-arg=--from --stdio-arg=mcp-server-fetch --stdio-arg=mcp-server-fetch --analyzers yara --format summary

Things to know

  • Several analyzers need API keys, such as the Cisco AI Defense API, an LLM provider, or VirusTotal.
  • Without VIRUSTOTAL_API_KEY, binary files are not scanned for malware.
  • Requires Python 3.11+ and uv.

Topics

#mcp#ai-security#agent-security#yara#llm#vulnerability-scanning#prompt-injection#python#agents#ai

FAQ

What is mcp-scanner?
A Python tool from Cisco that scans MCP servers, tools, prompts and source code for security threats using YARA rules, LLM analysis and Cisco AI Defense. MCP Scanner checks Model Context Protocol servers and their tools for potential malicious behavior and security findings. It can scan tools, prompts, resources and server instructions from remote servers (SSE or streamable HTTP), local stdio servers, or pre-generated JSON files for offline use in CI/CD pipelines.
Is mcp-scanner free to use? What license does it have?
mcp-scanner is open source under the Apache-2.0 license. Check the license terms before using it in commercial products.
Is mcp-scanner still maintained?
Actively maintained. The last commit to mcp-scanner was on Oct 16, 2026.
What can I use mcp-scanner for?
Vetting third-party MCP servers before connecting them to an AI agent. Adding offline MCP tool-definition checks to a CI/CD pipeline without API keys. Scanning PyPI or npm packages that provide MCP servers before installing them. Auditing MCP client configuration files already present on a developer machine.
How do I install mcp-scanner?
Install the CLI tool with uv: uv tool install --python 3.13 cisco-ai-mcp-scanner Run a YARA scan of a stdio MCP server: mcp-scanner --stdio-command uvx --stdio-arg=--from --stdio-arg=mcp-server-fetch --stdio-arg=mcp-server-fetch --analyzers yara --format summary
Where can I get mcp-scanner?
The source code and installation instructions are on GitHub: https://github.com/cisco-ai-defense/mcp-scanner

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects