Documentation

Every way to put an MCP server in front of MCP Sentinel's 183 detection rules, and what each one can and cannot check. A static scan reads the published package or repository without executing it. Read-only enumeration lists what a live endpoint declares and never invokes a tool. A sandbox run executes our own copy of a package inside a sandbox this host must first prove can block network egress and confine the filesystem. Every result leads with a coverage-aware verdict — Safe, Caution, Risk or Insufficient coverage — and shows which rules actually ran.

Ways to scan

Pick the surface that fits where you are: a browser, a terminal, a CI job, an MCP client or an AI agent. They all run the same rules and report the same verdict.

Scan any server

Paste a live URL, an npx/uvx launch command, an MCP client config, or a GitHub, npm or PyPI reference. A URL gets read-only enumeration; a package or repository gets a static scan; a sandbox run is offered only where this host can build a confining sandbox — never for a live URL. The form states a ceiling of how many rules the input can reach; the report shows what ran.

Open the scan form →Sandbox playground →

CLI — npx mcp-sentinel

A standalone static-analysis tool for the machine you are on. check scans the servers in your local MCP client config (Claude Desktop, Claude Code, Cursor, VS Code, Windsurf, Gemini CLI, Kiro and project-local mcp.json files are auto-discovered); scan <url> connects to a live server with read-only enumeration and runs the rules; discover lists every MCP config found across your tools; verify <path> checks a signed compliance report offline. --json is a stable contract, and --ci /--fail-on <severity> turn findings into an exit code.

npx mcp-sentinel check --ci
npx mcp-sentinel scan https://example.com/mcp --json
npx mcp-sentinel discover
npx mcp-sentinel verify ./report.json
Package on npm →

REST API

The public API is anonymous and read-only, apart from the three POSTs below that submit a scan, a sandbox run, or a cross-server analysis. Base URL: https://mcp-sentinelapi-production.up.railway.app. Responses carry the same verdict the registry shows.

  • GET /api/v1/servers — paginated, filterable list
  • GET /api/v1/servers/:slug
  • GET /api/v1/servers/:slug/findings
  • GET /api/v1/servers/:slug/history — verdict and findings over time
  • GET /api/v1/servers/:slug/badge.svg — verdict badge
  • GET /api/v1/servers/:slug/flow — sandbox-observed behavior; data: null when none on file
  • GET /api/v1/servers/:slug/compliance/:framework.{json,html,pdf} — signed report
  • GET /api/v1/servers/:slug/compliance/:framework/badge.svg
  • GET /api/v1/ecosystem/stats
  • GET /api/v1/scan/capabilities — the live rule ceilings per input kind
  • GET /api/v1/scan/:id — result of a submitted scan
  • POST /api/v1/scan — starts a static scan or a read-only enumeration
  • POST /api/v1/scan/jailed — anonymous sandbox run of a config (a legacy alias — POST /api/v1/scan with depth:"sandbox" is the primary path)
  • POST /api/v1/risk-matrix — cross-server analysis over listed servers; computes, stores nothing
  • GET /health
API root →Live rule ceilings →

Badge embed

The badge renders a server's coverage-aware verdict (Safe / Caution / Risk / Insufficient coverage) and links to its registry page. Replace YOUR-SERVER-SLUG with the slug from the server's URL.

[![MCP Sentinel verdict](https://mcp-sentinelapi-production.up.railway.app/api/v1/servers/YOUR-SERVER-SLUG/badge.svg)](https://mcp-sentinelweb-production.up.railway.app/servers/YOUR-SERVER-SLUG)
Find your server's slug →

MCP scanner server

npx mcp-sentinel-scanner is itself an MCP server. Add it to Claude, Cursor or any MCP client and ask in plain language: scan_server analyses tool metadata and source you pass in, scan_endpoint performs read-only enumeration of a live URL, and list_rules explains what is checked.

Setup guide →

Agent tools / WebMCP

This site registers WebMCP tools on document.modelContext, so a WebMCP-capable agent can query the registry or scan an npm/PyPI package directly. If you ship a WebMCP product, scan the tool surface it declares to agents — the page is honest about what a declared surface can and cannot check.

Agent tools →Scan a WebMCP page →

GitHub Action

Runs mcp-sentinel check --ci against the MCP config in your repository on every push or pull request and fails the job on a high or critical finding (override with fail-on). Outputs worst-verdict, findings-count and scanned for later steps.

action.yml →

What the words mean

Static scan
The published artifact or repository is fetched and analyzed. Nothing is executed.
Read-only enumeration
Against a live endpoint we call initialize and the list methods (tools/list, resources/list, prompts/list) and never invoke a tool.
Sandbox run
Our own copy of the published package, run inside a sandbox this host must first prove can block network egress and confine the filesystem. When it cannot, the run is refused and reported as not observed — never quietly downgraded.
Cross-server analysis
How two or more servers in one client configuration combine — needs at least two servers.
Cross-server flow
A path from one server's reader to another's sink. Always labelled observed (witnessed in a sandbox run) or inferred (joined statically from what the servers declare).
Kill-chain patterns
Multi-step attack chains matched against documented templates. Always hypothetical: a pattern the configuration permits, not something we watched happen.
Listed in the registry
The result is added to the public registry under the server's identity.
Not listed in the registry
Findings are returned to you and withheld from the public registry.
Rule-scoped run
You chose a subset of the rules to evaluate. The result is not an assessment of the server and is never listed in the registry.
Verdict
Risk when a critical finding or a lethal-trifecta pattern was observed; Caution on a high finding; Safe only when nothing serious was found and coverage was sufficient to certify it; otherwise Insufficient coverage. A clean result under thin coverage is never called Safe.

About the project

About MCP Sentinel

How the rules are built, how the scan pipeline runs, how the verdict is derived, and which frameworks the findings map to.

Read →

Responsible disclosure

How we report vulnerabilities found in MCP servers through our scanning, and how to reach us about a finding on your own server.

Policy →