Log inSubmit server
Heimdall logo

Heimdall

Scans MCP servers and agent configs for injection, risky capabilities, exfiltration paths, dependency issues, and drift.

InstallRepositoryWebsite
Full README Compare alternatives Embed widget Claim this listing

Install Heimdall

Pick your client, then add it in one click or paste the config.

STDIONode.js
~/Library/Application Support/Claude/claude_desktop_config.json
claude_desktop_config.json
{
  "mcpServers": {
    "heimdall": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-heimdall-scan"
      ]
    }
  }
}

Settings → Developer → Edit Config, merge this into mcpServers, then fully quit and reopen Claude Desktop.

We couldn’t confirm it starts correctly

We ran the install command but it didn't respond within our test window — this can mean a slow first-time install rather than a real problem.

npx -y mcp-heimdall-scan

Process exited before answering initialize.

This is an experimental automated check and can have false negatives — missing environment variables, a slow cold install, etc. It doesn’t necessarily mean something’s wrong. Last checked 3d ago.

Overview

The heimdall MCP server provides a local security scanner for MCP packages, repositories, configurations, and tool-list dumps. It performs static analysis by default, identifies injection patterns, capabilities, proven data flows, provenance issues, dependency vulnerabilities, composition risks, and surface drift, then applies a configurable policy. Its MCP interface exposes a static scan_mcp_server tool so an agent can vet a target before connecting to it. Reach for it before installing an untrusted server or in CI when MCP configuration changes need a pass, warn, or fail decision.

Use cases

  • Scan an MCP package before installing it
  • Audit a complete agent configuration for cross-server risks
  • Gate MCP changes in CI with a strict policy
  • Compare a server against a previous report for drift
  • Check declared dependencies for OSV.dev advisories

Key features

  • Static local scanning without executing servers by default
  • Injection and capability analysis
  • Proven exfiltration and data-flow detection
  • Cross-server composition checks
  • Policy-based verdicts with JSON and SARIF output
  • Optional dependency CVE and drift checks

Security & health

What it can reach and how reliably it runs — from our own checks, not the maintainer’s claims.

ActiveLast checked 2d ago

Recent health check succeeded.

10/10 checks healthy over the last 58d

Supply-chain signal

No high-severity advisories surfaced by our automated scan.

Critical 0High 0Medium 0Low 0

Scanned 4h ago via OSV.dev · mcp-heimdall-scan (npm)

Adoption & maintenance

Factual signals from GitHub, npm, and our automated checks — not a rating.

npm downloads196Package downloads in the last 30 days.
Last commit4mo agoMost recent push to the default branch.
Install checkInconclusiveDidn't respond in our test window — often a slow first install.

How Heimdall works

What the heimdall MCP server does

The heimdall MCP server examines MCP servers and agent configurations before they are trusted. It can accept an npm package, PyPI package, local directory, Git repository URL, tools.json dump, or MCP client configuration. The scanner also supports supplementing source analysis with a tools/list dump containing tools, resources, and prompts.

Its checks cover prompt and tool-description injection, including hidden characters, concealment, override language, and fake <IMPORTANT> tags. It inventories filesystem, network, shell, dynamic evaluation, and credential-related access such as SSH, AWS, keychain, and .env use. Data-flow analysis can identify located paths such as secret-to-network or fetch-to-eval rather than treating unrelated capabilities as proof of abuse.

The report also considers install-time scripts, repository and license metadata, dependency-inherited capabilities, optional OSV.dev advisories, cross-server exfiltration chains, tool-name collisions, and changes from a previous report. Findings cite a file and line or a tool name where available.

How it works

Analysis runs locally and is offline by default. The normal scan downloads or reads the target but does not execute the server, allowing a package to be reviewed before installation. A policy converts detector facts into a verdict: the built-in default, strict, or a user-supplied JSON policy can deny capabilities, require provenance, set severity thresholds, and record time-limited waivers.

The command-line interface uses heimdall <target> [options]. It returns exit code 0 for pass or warn, 1 for fail, and 2 for an error. JSON output supports automation, while SARIF 2.1.0 output can be used with code-scanning workflows. A baseline can be supplied to detect changes in a server's tool surface. The --online option checks declared dependencies against OSV.dev and sends dependency names for that lookup.

A separate validate mode performs a behavioral cross-check by running a server with capability recording and driving its tools.

Setup and configuration

For a one-off scan, use npx mcp-heimdall-scan with a package, path, URL, or configuration file. Node.js 18.17 or newer is indicated by the project metadata. The package also exports a TypeScript scan function for programmatic use.

To expose the scanner through MCP, configure an MCP client to launch npx -y --package mcp-heimdall-scan heimdall-mcp. The resulting scan_mcp_server tool accepts a target plus optional policy and online settings. This MCP interface is static-only: handshake and validation execution modes are not exposed to the agent.

For CI, the project provides a GitHub Action. Its inputs include the required target, a default or strict policy or policy-file path, optional OSV.dev checking, SARIF output, failure behavior, and a package version pin. The scan runs on the CI runner without a backend.

Tools and capabilities

The heimdall MCP server exposes scan_mcp_server, which can inspect npm and PyPI targets, local paths, GitHub URLs, tools/list files, and client configuration files. CLI capabilities include:

  • Injection and risky-capability detection
  • Proven data-flow and cross-server composition analysis
  • Provenance, dependency, and optional CVE checks
  • Baseline drift detection
  • Policy-based pass, warn, or fail decisions
  • JSON and SARIF reports

Use it when a model needs to assess an MCP target before adding it to its active configuration, or when a build should reject a configuration that violates procurement or security rules.

Read the full README View source on GitHub

Reviews

No reviews yet — be the first to share how it worked for you.

Frequently Asked Questions about Heimdall

heimdall is an MCP server that scans MCP packages, repositories, local paths, tool-list dumps, and agent configurations. Its main tool, scan_mcp_server, performs static checks for injection, risky capabilities, proven data flows, provenance issues, dependency advisories, composition risks, and drift before an agent connects to a target.

Run it through npx with `npx -y --package mcp-heimdall-scan heimdall-mcp` in your MCP client configuration. The scanner runs locally, requires no account or backend, and the MCP interface performs static analysis without exposing handshake or validation execution modes.

Use the provided GitHub Action with a required `target` and a selected policy such as `strict`. You can enable OSV.dev dependency checks, write SARIF output for code scanning, choose whether findings fail the job, and pin the scanner version for reproducible runs.

Yes, with the optional `--online` flag or the GitHub Action's `online` input. Heimdall checks declared dependency names against OSV.dev for known advisories and severity information; this option sends dependency names for the lookup, while normal analysis remains offline.

Related MCP servers

All in Security All alternatives
Add a badge to your READMEShow it’s listed — live SVG, Markdown or HTML.

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:
Live Dynamic SVG PreviewHeimdall AllMCPs Directory Badge
Markdown (GitHub README)
[![AllMCPs](https://allmcps.com/api/badge/heimdall?style=directory)](https://allmcps.com/mcp/heimdall)
HTML Embed
<a href="https://allmcps.com/mcp/heimdall"><img src="https://allmcps.com/api/badge/heimdall?style=directory" alt="Heimdall on AllMCPs" /></a>