Log inSubmit server
Agent Security Scanner MCP logo

Agent Security Scanner MCP

Scans agent-written code, MCP servers, prompts, actions, and dependencies for security risks and package hallucinations.

InstallRepositoryWebsite
Full README Compare alternatives Embed widget Claim this listing

Install Agent Security Scanner MCP

Pick your client, then add it in one click or paste the config.

STDIONode.js
~/Library/Application Support/Claude/claude_desktop_config.json
claude_desktop_config.json
{
  "mcpServers": {
    "agent-security-scanner-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "agent-security-scanner-mcp"
      ]
    }
  }
}

Settings → Developer → Edit Config, merge this into mcpServers, then fully quit and reopen Claude Desktop.

Automated check passed— started and listed 23 tools correctly (7d ago).

Overview

agent-security-scanner-mcp MCP server gives AI coding agents tools for scanning projects, MCP servers, prompts, actions, dependencies, and security findings. It can run as an npm CLI or be installed into supported coding clients so agents can invoke scanner tools. Results include compact, full, or minimal output, project A-F grades, findings, SBOM and vulnerability data, and compliance evidence. Reach for it before trusting agent-written code, adding an MCP server, accepting a dependency, or reviewing a generated change.

Use cases

  • Scan an agent-written repository before review
  • Audit an MCP server before installation
  • Check AI-suggested packages before adding dependencies
  • Review changed files before opening a pull request
  • Generate SBOM and compliance evidence before release

Key features

  • Project, file, and Git diff security scans
  • MCP server, prompt, and agent action checks
  • AI-suggested package existence verification
  • CycloneDX SBOM and OSV.dev vulnerability scanning
  • A-F project grades with configurable output verbosity
  • Compliance evidence and semantic review commands

Tools23

What Agent Security Scanner MCP lets your agent do. Expand a tool for its parameters.

Verified live~4.1k tokens of context

Security & health

What it can reach and how reliably it runs — from our own checks, not the maintainer’s claims.

ActiveLast checked Today

Recent health check succeeded.

6/6 checks healthy over the last 45d

What it can do

From the 23 tools this server returned when we ran it.

Runs commands · 1Handles credentials · 1Read-only tools · 22
Network at startup4 connections
Files written at startupNone
Install scriptspostinstall
npm provenanceNot published
Package age255 days
Maintainers1

Observed 2026-10-15 in an isolated sandbox. A description of reach, not a security audit.

Supply-chain signal

No high-severity advisories surfaced by our automated scan.

Critical 0High 0Medium 0Low 0

Scanned 9d ago via OSV.dev · agent-security-scanner-mcp (npm)

Adoption & maintenance

Factual signals from GitHub, npm, and our automated checks — not a rating.

GitHub stars124Stargazers on the source repository.
npm downloads2.2kPackage downloads in the last 30 days.
Last commit5d agoMost recent push to the default branch.
Availability100%Our rolling endpoint + install checks that succeeded.
Install checkPassedOur sandbox started it and listed its tools.
Tools exposed23Callable tools this server registers over MCP.
Directory activity2 viewsConfig copies, upvotes, and views on AllMCPs.

How Agent Security Scanner MCP works

What agent-security-scanner-mcp MCP server does

The agent-security-scanner-mcp MCP server examines code, repositories, MCP servers, prompts, agent actions, and package references for security and supply-chain risks. It is intended for workflows where an AI coding agent may trust new code, tools, documentation, dependencies, or generated commands.

Project and file scans can identify issues such as SQL injection, cross-site scripting, command injection, unsafe cryptography, and exposed secrets. MCP audits look for risks including instruction-like text in tool descriptions, names that resemble known tools, command execution concerns, and possible environment-variable exposure. Prompt and action checks address injection, jailbreak attempts, and potentially unsafe shell, file, or network operations.

Package checks verify whether AI-suggested imports or dependencies exist. SBOM commands generate CycloneDX data and scan dependencies through OSV.dev.

How it works

The scanner is distributed as an npm package and can be run with npx. It accepts a project directory, file, diff range, MCP server path, prompt, action type, package name, or dependency file depending on the command. Output supports minimal counts, compact findings for agents and people, or full audit detail.

Project scans return an A-F security grade with findings. Diff scans focus on changed files, while semantic review uses project intent to identify context-aware issues when rule-based checks are insufficient. The package also includes commands for generating shareable scan material, exporting Vanta evidence, checking local setup health, and evaluating technical compliance controls.

Setup and configuration

Run a project scan directly with npx agent-security-scanner-mcp scan-project .. Use init to install the scanner into Claude Code, Cursor, Claude Desktop, Windsurf, or Cline, then restart the client so the agent can call it as an MCP tool. The repository also documents setup commands for Kilo Code, OpenCode, and Cody, which are outside the compatible-client list used here.

For CI, init-ci github generates a GitHub workflow. A local demo can create test fixtures, scan them, and remove them afterward.

Tools and capabilities

The agent-security-scanner-mcp MCP server exposes these tool families:

  • scan_security, fix_security, scan_git_diff, and scan_project for repository and code security.
  • scan_mcp_server and scan_skill for MCP and AI skill audits.
  • scan_agent_prompt and scan_agent_action for prompt and action safety checks.
  • check_package and scan_packages for package-existence and import verification.
  • sbom_generate, sbom_scan_vulnerabilities, sbom_diff, and sbom_export_report for supply-chain evidence.
  • get_compliance_controls and evaluate_compliance for SOC 2, GDPR, and AIUC-1 technical evidence.
  • scanner_health for runtime diagnostics.

The CLI additionally provides doctor, quickstart, share-kit, and export-vanta. A bundled cr-agent command performs LLM-assisted semantic review and can emit SARIF output.

Limitations and notes

The material describes detection and review workflows; it does not establish that every finding is automatically fixed or that a scan proves a project is secure. Package verification checks whether names exist, which addresses hallucinated or nonexistent packages but does not by itself establish that a dependency is safe.

The documented client setup covers Claude Code, Cursor, Claude Desktop, Windsurf, and Cline, with additional commands shown for other clients.

Read the full README View source on GitHub

Reviews

No reviews yet — be the first to share how it worked for you.

Frequently Asked Questions about Agent Security Scanner MCP

agent-security-scanner-mcp is an MCP server that connects AI coding clients to scanners for local projects, MCP servers, prompts, actions, and dependencies. Its main tools include code and repository scans, MCP audits, prompt and action checks, package verification, SBOM vulnerability scans, compliance evaluation, and runtime diagnostics.

Install it in a supported client with `npx agent-security-scanner-mcp init <client>`.

Run `npx agent-security-scanner-mcp scan-mcp ./path/to/mcp-server --verbosity compact`. The audit checks MCP-specific risks such as instruction-like tool descriptions, spoofed or similar tool names, command execution concerns, and possible secret exposure.

Yes, it verifies whether AI-suggested package names exist. Use `check-package <name> <ecosystem>` for one package or `scan-packages <file> <ecosystem>` for imports and dependencies; the documented ecosystems include npm, PyPI, RubyGems, crates.io, pub.dev, CPAN, and raku.land.

Related MCP servers

All in Security All alternatives
Add a badge to your READMEShow it’s listed — live SVG, Markdown or HTML.

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:
Live Dynamic SVG PreviewAgent Security Scanner MCP AllMCPs Directory Badge
Markdown (GitHub README)
[![AllMCPs](https://allmcps.com/api/badge/agent-security-scanner-mcp?style=directory)](https://allmcps.com/mcp/agent-security-scanner-mcp)
HTML Embed
<a href="https://allmcps.com/mcp/agent-security-scanner-mcp"><img src="https://allmcps.com/api/badge/agent-security-scanner-mcp?style=directory" alt="Agent Security Scanner MCP on AllMCPs" /></a>