MCP Security Scanner

Find vulnerabilities in your MCP servers before your AI agent goes live.

Static analysis security scanner for Model Context Protocol servers. 13 rules mapped to the OWASP MCP Top 10. TypeScript + Python. Extension for VS Code and compatible editors (Cursor, Windsurf, Antigravity) + CLI + GitHub Action.

Powered by KERN — the structural language for AI-generated code.

Why

Every AI tool is adding MCP support. Security scanning hasn't kept up. MCP servers handle file I/O, shell commands, network requests, and database queries — all triggered by LLM tool calls. One missing input validation and your agent becomes an attack surface.

This scanner catches those issues at development time.

Features

Security Score (0-100)

Every MCP server gets a security score based on four weighted metrics:

Grades: A (90+), B (75+), C (60+), D (40+), F (<40)

13 Security Rules (OWASP MCP Top 10)

KERN IR Visualization

The sidebar renders your MCP server's security structure as a tree:

• Actions — each server.tool() or @mcp.tool() handler
• Effects — dangerous operations (shell exec, file I/O, network, database)
• Guards — validation, path containment, auth checks
• Color-coded: GUARDED (green) vs UNGUARDED (red)

Autofixes (TypeScript + Python)

6 one-click fixes for both languages:

• eval() to JSON.parse() (TS) / ast.literal_eval() (Python)
• Path traversal guard insertion
• Input validation scaffolding (Zod / Pydantic)
• Auth middleware stub
• Response sanitization
• Secrets to env vars

Config Guardian

Scans your MCP configuration files (claude_desktop_config.json, .cursor/mcp.json, .vscode/mcp.json, .windsurf/mcp.json) for:

• Hardcoded secrets (Shannon entropy + pattern detection)
• Missing version pins on npx/uvx packages (supply chain risk)
• @latest treated as error — it's NOT a version pin
• Wide permission flags (--allow-all, --no-sandbox)
• Unresolvable command paths

Shows a "My MCP Servers" section in the sidebar with trust indicators.

Tool Pinning (Rug-Pull Detection)

Pin your MCP server's tool schemas to detect unauthorized changes:

kern-mcp-security --lock ./src/server.ts     # generate lockfile
kern-mcp-security --verify ./src/server.ts   # check for drift

Detects: removed tools, new tools, description changes (tool poisoning), schema changes.

Badge + README Integration

Generate a Shields.io security badge for your project:

KERN: Generate MCP Security Badge

Writes a badge, per-tool score table, and JSON report to your README between <!-- kern-mcp-security-start/end --> markers.

CLI

npx @kernlang/review-mcp ./src/server.ts

Options: --format json|sarif|text, --threshold 60 (fail if below), --quiet, --output report.json.

See @kernlang/review-mcp for full CLI docs.

GitHub Action

Add to .github/workflows/mcp-security.yml:

name: MCP Security
on: [push, pull_request]
jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: KERNlang/kern-lang/packages/review-mcp/ci@main
        with:
          threshold: 60        # fail if score < 60
          sarif: true          # upload to GitHub Code Scanning
          comment: true        # post score + findings to PR

Outputs: score, grade, findings. See CI action source for all inputs.

Contact

• CLI / CI / docs: kernlang.dev
• Email: hello@kernlang.dev

Usage

Works in VS Code, Cursor, Windsurf, Antigravity, and other compatible editors.

1. Install the extension
2. Open an MCP server file (TypeScript, JavaScript, or Python)
3. The sidebar shows score, IR tree, and findings
4. Click any finding to jump to the line
5. Use Cmd+Shift+M / Ctrl+Shift+M to scan manually
6. Right-click for "KERN: Scan MCP Server" in the context menu

Configuration

Project-level config via .mcpsecurityrc.json:

{
  "enabled": true,
  "severity": "errors"
}

Architecture

The extension spawns a lightweight MCP subprocess for analysis — the editor stays fast. The engine combines three layers:

1. Legacy regex rules — fast pattern matching for known vulnerability patterns
2. Compiled .kern rules — declarative, human-auditable rules with taint tracking and guard dependencies
3. KERN IR inference — translates MCP server code to KERN's intermediate representation, checks structural invariants (effects must have guards)

No network calls. No telemetry. Everything runs locally.

Real-World Results

Tested against the official MCP servers and the vulnerable-mcp-servers-lab:

All 7 lab servers detected. Catches command injection (eval), hardcoded secrets, prompt injection, data injection markers, SSRF, unsanitized external data, missing auth on remote servers, system info disclosure, typosquatting, and rug-pull patterns.

Requirements

• VS Code 1.85+ or compatible editor (Cursor, Windsurf, Antigravity)
• Node.js 18+ (for the CLI)
• MCP servers using @modelcontextprotocol/sdk (TypeScript) or mcp.server / FastMCP (Python)

Links

• KERN Language — the structural language powering the analysis
• OWASP MCP Top 10 — the security framework we map to
• Contact — bug reports, feature requests, commercial licensing

License

Part of the KERN project. AGPL-3.0 — free for individuals and open-source projects. Commercial use requires a license. See LICENSE.