mcp-scan: Security scanner for MCP server configurations
mcp-scan is a security scanner for MCP (Model Context Protocol) server configurations. MCP servers used with Claude Desktop run with full access to your filesystem and network, making security configuration important.
What mcp-scan checks
The tool scans your MCP configurations for several security issues:
- Secrets and API keys accidentally left in config files
- Known vulnerabilities in MCP packages
- Suspicious permission patterns
- Exfiltration vectors
- Tool poisoning attacks
Supported clients and usage
mcp-scan auto-detects configurations for multiple AI clients including:
- Claude Desktop
- Cursor
- VS Code
- Windsurf
- 6 other AI clients (specific names not provided in source)
The tool is run with a single command:
npx mcp-scanThis type of security scanning is particularly relevant for MCP servers since they often have broad system access when integrated with AI coding assistants. The tool appears to focus on configuration-level security issues rather than runtime vulnerabilities.
📖 Read the full source: r/ClaudeAI
👀 See Also
Fake Claude site delivers PlugX malware via sideloading attack
A fake Claude website serves a trojanized installer that deploys PlugX malware through DLL sideloading, giving attackers remote access to compromised systems. The attack uses a legitimately signed G DATA antivirus updater to load malicious code.
Audio-Layer Prompt Injection Against Claude: What's Not in the Transcript
A builder of a prompt injection detection API shares findings on audio-layer attacks against Claude, revealing that attacks in the signal (not transcript) are invisible in logs and pose a real threat to voice agents.
Developer Builds Firecracker MicroVM Sandbox for OpenClaw Security
A developer concerned about LLM security built a bare-metal sandbox using Firecracker microVMs to isolate OpenClaw scripts, with each script running in its own Linux kernel with 128MB RAM cap and no network by default.
Nullgaze: Open Source AI-Supported Security Scanner Released
Nullgaze is a new open source AI-supported security scanner that detects vulnerabilities specific to AI-generated code, boasting near-zero false positives.