Active project · v0.1 shipped

mcp-guard

Security auditor for MCP servers. A command-line tool that grades AI tool servers 0–100 — "Snyk for MCP".

What it is

mcp-guard is a command-line security scanner — not an app, not a website (yet). You point it at an MCP server — the thing that gives an AI assistant its tools — and it audits every tool that server exposes, looking for the structural flaws behind real MCP vulnerabilities: shell execution, path traversal, argument injection, tool poisoning, SSRF, missing auth.

It then grades the server 0–100 with a letter grade, like a health-inspection score for AI tool servers. Run it in CI with --fail-on high and a vulnerable server fails the build.

The commercial wedge: hosted continuous scanning, a vulnerability database, and compliance reporting — that’s the “Snyk for MCP” play. Those are queued under Up next.

Real scan — vulnerable demo server

Validated Sep 25, 2026

This is actual output from scanning the intentionally-vulnerable demo server (5 tools, 14 findings):

mcp-guard audit: demo/vuln_server.py

Tools enumerated: 5 · Score: 10/100 · Grade: F

Findings: 14 — 1 critical, 5 high, 3 medium, 5 info

[CRITICAL] EXEC-001 [run_shell] — Arbitrary command execution capability
A confused or jailbroken agent turns this into remote code execution.

[HIGH] TRAV-001 [read_file] — Unconstrained file path parameter
The structural shape behind CVE-2025-68143 (path traversal).

[HIGH] POISON-001 [search_docs] — Tool description contains embedded instruction
A ‘SYSTEM OVERRIDE’ directive an LLM reading it as context may obey (tool poisoning).

[HIGH] SSRF-001 [fetch_url] — Unrestricted URL fetching
SSRF vector into cloud metadata endpoints and internal services.

[MEDIUM] EXFIL-001 [search_docs] — Credential / environment access
Highest-value target for a prompt-injection exfiltration.

[INFO] ANNOT-001 — Missing safety annotations (×5 tools)

+ 8 more findings in the full JSON report.

The clean demo server scores 100/100 (A) — if the vulnerable one ever scores well, the scanner has regressed.

The 10 checks

Check	Severity	What it catches
`AUTH-001`	critical	Network transport (SSE/HTTP) with no Authorization header
`EXEC-001`	critical	Tool capable of arbitrary shell/OS command execution
`FILE-001`	high	File write/delete via unconstrained path
`TRAV-001`	high	Path parameter with no pattern constraint (CVE-2025-68143 shape)
`INJ-001`	high	Unbounded string parameter, no maxLength/pattern/enum (CVE-2025-68144 shape)
`POISON-001`	high	Embedded instructions in tool descriptions (tool poisoning)
`POISON-002`	high	Zero-width / bidi control characters (steganography)
`SSRF-001`	high	Caller-supplied URL fetching with no allowlist
`EXFIL-001`	medium	Access to secrets / env vars / key material
`ANNOT-001`	info	Missing MCP safety annotations

Use it

Quick start

pip install "mcp<2"
python -m mcp_guard.cli --stdio "python server.py"
python -m mcp_guard.cli --sse https://example.com/mcp --header "Authorization: Bearer $TOKEN"
python -m mcp_guard.cli --stdio "python server.py" --json --fail-on high

GitHub Action

Drop-in audit for any MCP server repo:

- uses: actions/checkout@v4
- uses: Martinezworldwide/ZiggyBook/projects/mcp-guard@v1
  with:
    stdio: "python server.py"
    fail-on: high

Every run posts the score/grade to the job summary and uploads the full JSON report as an artifact.

Source on GitHub →