mcp-scan: Security scanner for MCP server configurations
mcp-scan is a security scanner for MCP (Model Context Protocol) server configurations. MCP servers used with Claude Desktop run with full access to your filesystem and network, making security configuration important.
What mcp-scan checks
The tool scans your MCP configurations for several security issues:
- Secrets and API keys accidentally left in config files
- Known vulnerabilities in MCP packages
- Suspicious permission patterns
- Exfiltration vectors
- Tool poisoning attacks
Supported clients and usage
mcp-scan auto-detects configurations for multiple AI clients including:
- Claude Desktop
- Cursor
- VS Code
- Windsurf
- 6 other AI clients (specific names not provided in source)
The tool is run with a single command:
npx mcp-scanThis type of security scanning is particularly relevant for MCP servers since they often have broad system access when integrated with AI coding assistants. The tool appears to focus on configuration-level security issues rather than runtime vulnerabilities.
📖 Read the full source: r/ClaudeAI
👀 See Also
OpenClaw Security: The Hardened Baseline You Should Start With
Self-hosting OpenClaw doesn't automatically make it secure. A Reddit post details the hardened baseline config: local-only Gateway, per-peer DM isolation, deny runtime/fs/automation tool groups, exec locked down, and mention-gated groups.
MCP Server CVE Exposure Mapping and Public API Released
Researchers have mapped CVE exposure across thousands of MCP servers and built a public API for querying dependency vulnerabilities. The API allows searching by repo/name, filtering by severity, and sorting by CVE count or recency.
Anthropic reports industrial-scale distillation attacks by Chinese AI labs on Claude
Anthropic detected three Chinese AI companies—DeepSeek, Moonshot, and MiniMax—creating over 24,000 fraudulent accounts to generate 16+ million exchanges with Claude, extracting its reasoning capabilities through systematic distillation attacks.
From Farm to Code: How a Farmer Created an Open-Source Runtime Defense for OpenClaw
Discover how a farmer, with no prior development experience, created an open-source runtime defense for OpenClaw using multiple AI coding agents in just 12 hours.