# muhannad-hash/mcp-shield [Health: Active]

**Category:** 🔒 Security  
**Repository:** https://github.com/muhannad-hash/mcp-shield  
**GitHub Stars:** 2  
**npm Downloads (last month):** 414  
**Views:** 5  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/muhannad-hash-mcp-shield

## Description
Security scanner for MCP servers. Detects backdoors, exfiltration code, obfuscation, dangerous code execution, prompt injection, and supply chain risks before you install. Four tools: scan npm packages, scan local directories, check prompt injection, and audit supply chain trust score. npx @muhannad-hash/mcp-shield

## Tools
Capabilities this server exposes over MCP:

- **scan_package** — Download an npm MCP package and scan it for malicious patterns
- **scan_directory** — Scan a local MCP server directory (cloned from GitHub, etc.)
- **check_prompt_injection** — Check tool descriptions or responses for hidden injections
- **audit_supply_chain** — Get trust score, CVEs, maintainer count, and age for any npm package

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `npx` (confidence: high):

```json
"mcpServers": {
  "mcp-shield": {
    "command": "npx",
    "args": ["-y","mcp-shield"]
  }
}
```

## Documentation

## What muhannad-hash/mcp-shield MCP server does

The muhannad-hash/mcp-shield MCP server reviews MCP server code and package metadata for security risks. It can analyze an npm package before installation, inspect a local directory such as a GitHub clone, look for prompt injection in text, and report supply-chain information for an npm package.

The scanner covers possible credential or data exfiltration, shell and dynamic code execution, obfuscation, access to sensitive files, and LLM-targeting instructions. Examples include reads of environment variables, SSH keys, AWS credentials, `.env` files, browser cookies, or `~/.gitconfig`; network transmission of sensitive data; `eval()`, dynamic `require()`, and child-process execution; and hidden or zero-width prompt instructions.

## How it works

For source analysis, muhannad-hash/mcp-shield MCP server examines JavaScript and TypeScript files with regular-expression signatures. Findings include severity, category-specific identifiers, source location, and the relevant code where available.

Package analysis uses an installation step configured with `--ignore-scripts`, preventing package lifecycle scripts from running while the package is being examined. This is intended to avoid executing malicious postinstall hooks during the scan.

Supply-chain checks query npm package metadata and run `npm audit` against the dependency tree. Results can include package age, weekly downloads, maintainer count, trust score, and known CVEs. Prompt-injection checks inspect tool descriptions or responses for hidden instructions, role changes, jailbreak patterns, zero-width characters, and related techniques.

## Setup and configuration

The documented no-install option adds the server to Claude with `npx`:

```bash
claude mcp add mcp-shield -- npx mcp-shield
```

You can instead install it globally and register the executable:

```bash
npm install -g mcp-shield
claude mcp add mcp-shield -- mcp-shield
```

Manual Claude configuration places an `mcp-shield` entry in `~/.claude/claude_mcp_config.json`, using `npx` as the command and `mcp-shield` as its argument. Development instructions use a cloned repository, `npm install`, and `npm run dev`. No environment variables are documented.

## Tools and capabilities

The muhannad-hash/mcp-shield MCP server exposes four tools:

- `scan_package` downloads an npm MCP package and scans it for malicious patterns.
- `scan_directory` examines a local MCP server directory, including one cloned from GitHub.
- `audit_supply_chain` retrieves an npm package trust score, CVEs, maintainer count, and age.

Use prompts such as asking to scan an npm package before installation, inspect a local project directory, evaluate pasted tool text, or audit installed MCP servers.

_Full upstream README: https://allmcps.com/mcp/muhannad-hash-mcp-shield/readme_