# MCPAmpel - MCP Security Scanner [Health: Active]

**Category:** 🔒 Security  
**Repository:** https://github.com/MCPAmpel/mcpampel  
**GitHub Stars:** 2  
**Views:** 0  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/mcpampel-mcp-security-scanner

## Description
Scan installed MCP servers for security vulnerabilities with 16 detection engines.

## Tools
Capabilities this server exposes over MCP:

- **scan_my_servers** — Discovers all MCP servers from your editor config and scans them with 16 engines. Returns a summary table with trust scores. No input needed.
- **scan_url** — Scan a single GitHub, GitLab, npm, or PyPI URL. Returns trust score, engine breakdown, and findings.
- **check_status** — Show your daily quota usage and remaining scans.
- **get_scan_results** — Get detailed results for a specific scan by ID. Use after `scan_my_servers` or `scan_url` to drill into findings.

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `uvx` (confidence: high):

```json
"mcpServers": {
  "mcpampel-mcp-security-scanner": {
    "command": "uvx",
    "args": ["mcpampel"],
    "env": {
      "MCPAMPEL_API_KEY": "",
      "MCPAMPEL_BASE_URL": ""
    }
  }
}
```

**Requires environment variables:** `MCPAMPEL_API_KEY`, `MCPAMPEL_BASE_URL` — the values above are empty placeholders; fill in real credentials before running (see the repository for what each one is for).

## Documentation

## What MCPAmpel - MCP Security Scanner MCP server does

MCPAmpel - MCP Security Scanner MCP server evaluates MCP servers for security vulnerabilities through a remote scanning service. It can inspect servers already present in supported editor configuration files or analyze one public source URL at a time. Results include an aggregated trust score and information from the individual detection engines.

The local discovery workflow is intended for reviewing the MCP servers configured for an AI development environment. The URL workflow is useful when a server has not yet been installed, but its source is available through GitHub, GitLab, npm, or PyPI.

## How it works

The server runs as a local MCP process and communicates with the MCPAmpel API. When `scan_my_servers` is called, it reads supported editor configuration locations, identifies configured MCP servers, and sends them for analysis. The tool requires no input parameters.

`scan_url` sends a supplied GitHub, GitLab, npm, or PyPI URL for scanning. The response provides a trust score, an engine-by-engine breakdown, and detected findings. Both scan methods produce a scan record that can be examined further with `get_scan_results` using its scan ID.

The service tracks API usage against a daily allowance. `check_status` reports the amount used and the number of scans remaining.

## Setup and configuration

Run the server with `uvx mcpampel`. Register an account at mcpampel.com to obtain an API key, then add the server to the MCP configuration used by your client. The documented configuration locations are:

- Claude Code or Claude Desktop: `~/.claude/settings.json` or `claude_desktop_config.json`
- Cursor: `~/.cursor/mcp.json`
- Windsurf: `~/.codeium/windsurf/mcp_config.json`
- Gemini CLI: `~/.gemini/settings.json`

Set `MCPAMPEL_API_KEY` in the server's environment. `MCPAMPEL_BASE_URL` is optional and defaults to `https://mcpampel.com`, allowing the API endpoint to be configured explicitly.

## Tools and capabilities

The MCPAmpel - MCP Security Scanner MCP server exposes four tools:

- `scan_my_servers` discovers configured MCP servers and scans them with 16 engines, returning a summary table and trust scores.
- `scan_url` accepts one supported GitHub, GitLab, npm, or PyPI URL and returns its trust score, engine results, and findings.
- `check_status` displays daily quota consumption and remaining scans.
- `get_scan_results` accepts a `scan_id` and returns detailed results for a previous scan started with `scan_my_servers` or `scan_url`.

## Limitations and notes

The included allowance is 50 API calls per day. Scanning depends on an API key and the MCPAmpel service.

The URL scanner supports GitHub, GitLab, npm, and PyPI URLs only. A detailed result lookup also requires the scan ID returned by an earlier scan. The documentation identifies the project license as Apache License 2.0.

_Full upstream README: https://allmcps.com/mcp/mcpampel-mcp-security-scanner/readme_