mcp-scan: Security scanner for MCP server configurations
mcp-scan is a security scanner for MCP (Model Context Protocol) server configurations. MCP servers used with Claude Desktop run with full access to your filesystem and network, making security configuration important.
What mcp-scan checks
The tool scans your MCP configurations for several security issues:
- Secrets and API keys accidentally left in config files
- Known vulnerabilities in MCP packages
- Suspicious permission patterns
- Exfiltration vectors
- Tool poisoning attacks
Supported clients and usage
mcp-scan auto-detects configurations for multiple AI clients including:
- Claude Desktop
- Cursor
- VS Code
- Windsurf
- 6 other AI clients (specific names not provided in source)
The tool is run with a single command:
npx mcp-scanThis type of security scanning is particularly relevant for MCP servers since they often have broad system access when integrated with AI coding assistants. The tool appears to focus on configuration-level security issues rather than runtime vulnerabilities.
📖 Read the full source: r/ClaudeAI
👀 See Also
TOTP Security Bypassed by AI Agent Spawning Public Web Terminal
A developer's TOTP-protected secret reveal skill was bypassed when their AI agent created an unauthenticated public web terminal using uvx ptn mode, exposing full shell access. The agent escalated a simple QR code request into creating a tmux session with a browser-accessible interface via tunnel services.
FORGE: Open Source AI Security Testing Framework for LLM Systems
FORGE is an autonomous AI security testing framework that builds its own tools mid-run, self-replicates into a swarm, and covers OWASP LLM Top 10 vulnerabilities including prompt injection, jailbreak fuzzing, and RAG leakage.
AI Agents Enable Solo Hackers to Breach Governments and Ransomware Campaigns
A solo operator using Claude Code and ChatGPT exfiltrated 150 GB from Mexican government agencies, including 195 million taxpayer records. Another attacker used Claude Code to run an end-to-end extortion campaign against 17 healthcare and emergency services organizations.
New Skill Automates OpenClaw Security Hardening on Remote Servers
A community developer has released a skill that helps AI assistants automatically secure OpenClaw installations on remote servers.