Scan your MCP server
Run a live security scan against 179 deterministic detection rules. Submit a URL, paste the npx or uvx line from a README, paste your MCP client config, or point at a GitHub repo or npm package. Every successful scan is added to the public registry.
A remote MCP server endpoint (HTTP / SSE). Add a credential below if it is auth-walled.
Sent as request headers on the MCP handshake. Optional — leave blank to scan anonymously.
- Used for this scan, never stored. The credential is held in memory for the length of one scan. The saved record keeps the URL and the results — never the headers you enter here.
- A token does not widen what we call. The scanner still only calls
initializeandtools/list. What may be invoked is bounded by whose server is on the other end, not by what credential we are holding — there is no path here that invokes one of your tools. - A refused credential is reported as its own result. If the server rejects it you get credential-rejected — the credential reached the server and was refused — which is a different finding from this server requires authentication, which means we arrived with nothing. If the report says the scan connected anonymously, what you entered never reached the scanner.
Full registry scan — all 179 active rules
Every one of the 179 active rules is browsable and individually selectable above — nothing a full registry scan runs is hidden from this catalogue.
What gets checked
Live URL
Connects over MCP, enumerates tools, resources and prompts, and runs the description, schema, protocol-surface and adversarial-AI rule families (~60–80 rules). Supply a header and an auth-walled commercial server is reachable too — the scan still only calls initialize and tools/list.
Launch command & config
A stdio entry — npx -y @scope/server — names a published package. We read the name off the command, download that exact release, verify its registry integrity and analyze it. Nothing is executed. This is most of the MCP ecosystem.
GitHub / npm source
Fetches the source and dependency manifest, unlocking the full179-rule suite — including code-analysis, dependency and supply-chain rules. A monorepo subpath (/tree/main/src/thing) is scanned in scope, not from the repository root.
Honest coverage
Every report says what it did not check. A rule that never got its inputs is reported as never checked — a coverage gap, not a pass — and kept distinct from a rule that had its inputs and found the project genuinely clean.