# rob925/mcp-shield [Health: Active]

**Category:** 🔒 Security  
**Repository:** https://github.com/rob925/mcp-shield  
**GitHub Stars:** 1  
**Views:** 1  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/rob925-mcp-shield

## Description
Static security scanner and MCP server for MCP servers and AI agent tools. Detects secrets, shell execution, risky tool descriptions, environment access, and prompt-injection phrases. mcp-shield-server

## Claude Desktop Quick Installation
Heuristic fallback — verify the package name and runner against the repository README before running it. Uses `npx` (confidence: low):

```json
"mcpServers": {
  "mcp-shield": {
    "command": "npx",
    "args": ["-y","rob925-mcp-shield"]
  }
}
```

## Documentation & README

# MCP Shield

[![Python](https://img.shields.io/badge/python-3.10%2B-blue)](https://www.python.org/)
[![CI](https://github.com/rob925/mcp-shield/actions/workflows/ci.yml/badge.svg)](https://github.com/rob925/mcp-shield/actions/workflows/ci.yml)
[![License: MIT](https://img.shields.io/badge/license-MIT-green.svg)](LICENSE)
[![MCP](https://img.shields.io/badge/MCP-server-blueviolet)](https://modelcontextprotocol.io/)

Security scanner and MCP server for Model Context Protocol servers, tools, prompts, and AI agent projects.

MCP gives agents access to tools. MCP Shield helps you catch the obvious dangerous parts before they reach production: leaked secrets, shell execution, risky tool descriptions, prompt-injection text, and CI-breaking security regressions.

```bash
mcp-scan .
```

```text
[HIGH] code.shell_true server.py:42
  Shell execution is enabled.
  subprocess.run(cmd, shell=True)

[CRITICAL] secret.literal .env:1
  Possible hard-coded secret.
  OPENAI_API_KEY="sk-..."
```

## Why MCP Shield

MCP servers often expose powerful capabilities: filesystem access, shell commands, network calls, credentials, browser automation, databases, and internal tools.

That is exactly where small mistakes become expensive:

- a tool description encourages unsafe behavior
- a test key becomes a real leaked token
- an agent can call a shell command with user-controlled input
- a prompt or resource contains injection text
- CI has no security gate for MCP-specific risks

MCP Shield is the simple first line of defense: fast static checks, useful output, and a non-zero exit code when risk crosses your threshold.

## Features

- runs as both a CLI and an MCP server
- built on the official MCP Python SDK
- CI-friendly severity gates
- text, JSON, Markdown, and SARIF output
- inline suppressions with rule IDs
- `.mcp-scan-ignore` for fixtures and intentional demos

## What It Finds

| Risk | Examples |
| --- | --- |
| Hard-coded secrets | API keys, tokens, passwords, private keys |
| Process execution | `subprocess`, `child_process`, `shell=True` |
| MCP tool risk | tools named or described as delete, shell, token, secret, filesystem |
| Environment access | `os.environ`, `process.env` |
| Prompt injection text | "ignore previous instructions", system prompt leakage phrases |

## Install

From a local checkout:

```bash
pip install .
```

Run without installing:

```bash
python -m mcp_security_scanner.cli .
```

## MCP Server

Run MCP Shield as a stdio MCP server:

```bash
mcp-shield-server
```

Available tools:

- `scan_path_tool` - scan a local MCP server or agent project
- `list_rules` - list rule IDs and descriptions

Example Claude Desktop-style command:

```json
{
  "mcpServers": {
    "mcp-shield": {
      "command": "mcp-shield-server"
    }
  }
}
```

## Usage

```bash
mcp-scan .
mcp-scan path/to/mcp-server
mcp-scan . --format json
mcp-scan . --format markdown --output mcp-security-report.md
mcp-scan . --format sarif --output mcp-shield.sarif
mcp-scan . --fail-on medium
```

Formats:

- `text` for humans
- `json` for automation
- `markdown` for PR comments and reports
- `sarif` for GitHub code scanning

Severity gates:

- `low`
- `medium`
- `high`
- `critical`

`--fail-on high` exits with code `1` when any high or critical finding exists.

## Ignore Files

Create `.mcp-scan-ignore` in the scanned directory:

```gitignore
tests/
fixtures/
examples/unsafe-demo.py
```

Use this for intentional fixtures and demos. Do not use it to hide production risks.

## Suppressions

Suppress a reviewed finding on the same line:

```py
subprocess.run(cmd)  # mcp-shield: ignore code.subprocess
```

Use `all` only for test fixtures:

```py
subprocess.run(cmd, shell=True)  # mcp-shield: ignore all
```

## Example

Scan the intentionally unsafe example:

```bash
python -m mcp_security_scanner.cli examples/unsafe-mcp-server --fail-on critical
```

## GitHub Actions

```yaml
name: MCP security scan

on: [push, pull_request]

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"
      - run: pip install .
      - run: mcp-scan . --fail-on high
```

## Roadmap

- MCP SDK-aware parsing for Python and TypeScript servers
- safer default rule pack for enterprise MCP servers
- prompt/resource-specific injection checks
- PyPI release for `pipx install mcp-shield`

## Repository Topics

Add these GitHub topics for discovery:

```text
mcp, model-context-protocol, ai-agents, security, security-tools, scanner, devtools, llm, prompt-injection, static-analysis
```

GitHub recommends repository topics because they help people discover and contribute to projects by purpose and subject area.

## Scope

MCP Shield is a static heuristic scanner. It catches common risks early, but it is not a full security audit.

## Help It Grow

MCP security is moving fast. The most useful contributions right now are real-world unsafe MCP examples, low-noise detection rules, and CI integrations.

If MCP Shield catches something useful, star the repo so more MCP builders can find it.