MCP Server

mcp-sentinel-scanner

Scan any MCP server against 184 security detection rules - directly from Claude, Cursor, or any MCP client.

npx mcp-sentinel-scanner

No MCP client handy? Prefer the web form? Scan a server →

Quick Setup

1

Add to Claude Desktop

Open your Claude Desktop config and add the scanner as an MCP server:

{
  "mcpServers": {
    "mcp-sentinel-scanner": {
      "command": "npx",
      "args": ["-y", "mcp-sentinel-scanner"]
    }
  }
}
2

Ask Claude to scan

Just ask in natural language. The scanner exposes three tools that Claude can call:

Scan a live endpoint“Scan the MCP server at https://api.example.com/mcp for security issues”
Analyze server metadata“Check this MCP server's tools for prompt injection risks”
List detection rules“What security rules does the scanner check for?”
3

Get actionable results

Every finding includes evidence (what triggered it) and remediation (how to fix it).

Available Tools

scan_server

Analyze server metadata without a live connection. Pass tools, descriptions, source code, and dependencies. Returns findings + verdict.

Input: tools, source code, dependenciesOutput: findings + verdict

scan_endpoint

Connect to a live MCP server endpoint. Enumerates tools via initialize + tools/list (safe, read-only), then runs all 184 detection rules.

Input: endpoint URLOutput: findings + verdict + connection info

list_rules

List all available detection rules. Filter by category or severity to explore specific rule sets.

Input: optional category/severity filterOutput: rule list with names, categories, severity

Example Output

What a scan result looks like:

{
  "server_name": "my-mcp-server",
  "verdict": "risk",
  "verdict_summary": "Risk - a critical issue (or a lethal-trifecta
    capability pattern) was observed across 3 findings.",
  "lethal_trifecta": false,
  "severity_counts": {
    "critical": 1,
    "high": 1,
    "medium": 1,
    "low": 0,
    "informational": 0
  },
  "findings_count": 3,
  "findings": [
    {
      "rule": "Prompt Injection in Tool Description",
      "severity": "critical",
      "evidence": "Tool description contains injection pattern:
        'ignore all previous instructions'",
      "remediation": "Remove instruction-like language from
        tool descriptions. Use factual, concise descriptions.",
      "rule_id": "A1"
    },
    {
      "rule": "Hardcoded Secrets",
      "severity": "high",
      "evidence": "Hardcoded API key pattern detected:
        sk-proj-abc123...",
      "remediation": "Move secrets to environment variables.
        Never hardcode API keys in source code.",
      "rule_id": "C5"
    },
    {
      "rule": "Missing Input Validation",
      "severity": "medium",
      "evidence": "Parameter 'query' has type string with
        no maxLength, pattern, or enum constraint.",
      "remediation": "Add maxLength, pattern, or enum
        constraints to string parameters.",
      "rule_id": "B1"
    }
  ],
  "rules_version": "2026.09"
}

Verdict Interpretation

A scan leads with a coverage-aware verdict, not a number. A clean result is only Safe when coverage was sufficient to certify it — otherwise it is Insufficient coverage, never Safe.

SafeCertified cleanCoverage was sufficient and nothing found warrants concern.
CautionReview recommendedFindings worth reviewing before you rely on this server.
RiskDo not deploySerious findings - fix before using in production.
InsufficientNot a passKey inputs were not analysed, so a clean result cannot be certified.

Detection Coverage

184 rules across 21 categories - counts derived from the live rule catalogue

A
Description AnalysisPrompt injection, unicode attacks, encoded instructions
9
B
Schema AnalysisMissing validation, dangerous defaults, unconstrained properties
7
C
Code AnalysisCommand injection, SSRF, SQL injection, hardcoded secrets
17
D
Dependency AnalysisKnown CVEs, typosquatting, malicious packages
7
E
Behavioral AnalysisMissing auth, insecure transport, declared-vs-observed divergence
7
F
Ecosystem ContextLethal trifecta, exfiltration chains, data flow risks
8
G
Adversarial AIIndirect injection, rug pull, context saturation
7
H
2026 Attack SurfaceOAuth vulnerabilities, initialize injection, multi-agent
3
I
Protocol SurfaceAnnotation deception, sampling abuse, consent fatigue
17
J
2026 Threat IntelligenceGit injection, schema poisoning, config poisoning
9
K
Compliance & GovernanceNIST, ISO 27001, EU AI Act, OWASP Agentic
20
L
Supply Chain AdvancedPost-install hooks, manifest confusion, secrets in build layers
16
M
AI Runtime ExploitationMulti-turn state injection, encoding attacks, unbounded tool chains
9
N
Protocol Edge CasesJSON-RPC batch/notification abuse, transport framing
15
O
Data Privacy AttacksTiming inference, sensitive local-data exfiltration
7
P
Infrastructure RuntimeContainer and Dockerfile misconfiguration
10
Q
Cross-Ecosystem EmergentMulti-protocol and cross-ecosystem emergent risks
7
R
MCP Apps / UI SurfaceUI HTML resource surface (ui://, SEP-1865)
1
S
Async Tasks AugmentationTerminal-state schema, task-handle caller identity
2
T
Streamable HTTP TransportStateless HTTP without auth, DNS-rebinding Origin gate
2
U
Schema 2020-12 + OAuthToken pass-through, audience validation, DCR consent reuse
4

Safety

The scanner never invokes tools on target servers. It only calls initialize and tools/list for enumeration. All analysis is deterministic - no LLM calls, no false positives from probabilistic models.

Other MCP Clients

Works with any MCP-compatible client:

CursorSettings → MCP → Add Server
VS Code (Copilot).vscode/mcp.json
Windsurf~/.codeium/windsurf/mcp_config.json
Claude Codeclaude mcp add mcp-sentinel-scanner