# rob925/mcp-shield [Health: Active]

**Category:** 🔒 Security  
**Repository:** https://github.com/rob925/mcp-shield  
**GitHub Stars:** 1  
**Views:** 1  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/rob925-mcp-shield

## Description
Static security scanner and MCP server for MCP servers and AI agent tools. Detects secrets, shell execution, risky tool descriptions, environment access, and prompt-injection phrases. mcp-shield-server

## Claude Desktop Quick Installation
No generated config for this server: it installs through its own setup steps.

The project's own setup steps (from https://github.com/rob925/mcp-shield), copied verbatim. Run them in order; they are not an mcpServers config.

1. Install:

```sh
pip install .
```

2. Start the server:

```sh
mcp-shield-server
```

3. Install:

```sh
pipx install mcp-shield
```

## Documentation

## What rob925/mcp-shield MCP server does

The rob925/mcp-shield MCP server performs static, heuristic checks against local MCP server code and AI agent projects. It looks for hard-coded API keys, tokens, passwords, and private keys; process execution patterns such as Python `subprocess`, Node.js `child_process`, and `shell=True`; and access to environment variables through patterns such as `os.environ` and `process.env`.

The scanner also evaluates MCP-related tool names and descriptions for terms associated with deletion, shells, tokens, secrets, and filesystem access. It checks text for prompt-injection language, including requests to ignore earlier instructions or expose system prompts. Results carry severities from low through critical and can be used as a CI gate.

## How it works

Install the Python package from a local checkout, then scan a directory with `mcp-scan .` or provide a narrower project path. The command can print human-readable text or write JSON, Markdown, or SARIF reports. SARIF is intended for code-scanning workflows, while Markdown can be used in pull-request reports.

A `--fail-on` threshold makes the command return exit code 1 when findings at that level or above are present. For example, a high threshold fails on high and critical findings. This makes the rob925/mcp-shield MCP server suitable for a GitHub Actions step that installs the package and scans the checked-out repository.

The scanner supports `.mcp-scan-ignore` files for paths such as tests, fixtures, and deliberately unsafe examples. Individual reviewed findings can also be suppressed on the same source line with a rule ID. The `all` suppression is documented for test fixtures only.

## Setup and configuration

Python 3.10 or newer is required. Install from the repository with `pip install .`, or run the module directly with `python -m mcp_security_scanner.cli .` without installing the command-line entry point.

To expose the rob925/mcp-shield MCP server to an MCP client, start `mcp-shield-server` as a stdio process. A Claude Desktop configuration can register that command under an `mcpServers` entry.

For CI, add a workflow step that checks out the repository, installs Python, installs the package, and runs `mcp-scan . --fail-on high`. Select the output format and destination with the corresponding CLI options.

## Tools and capabilities

The stdio MCP interface provides two tools:

- `scan_path_tool` scans a local MCP server or agent project.
- `list_rules` returns the available rule IDs and their descriptions.

The command-line interface accepts a path, output format, output file, and severity threshold. Supported formats are text, JSON, Markdown, and SARIF. Rule identifiers can be used in inline suppression comments, allowing a reviewed exception to target one finding rather than disabling the complete scan.

## Limitations and notes

rob925/mcp-shield is a static heuristic scanner, not a complete security audit. Its documented scope is catching common risks early, so a clean result should not be treated as proof that a project is safe. The roadmap mentions future MCP SDK-aware parsing for Python and TypeScript, additional enterprise rules, and more targeted prompt and resource injection checks; those items should not be assumed to be available now.

_Full upstream README: https://allmcps.com/mcp/rob925-mcp-shield/readme_