MCP Shield

What rob925/mcp-shield MCP server does

The rob925/mcp-shield MCP server performs static, heuristic checks against local MCP server code and AI agent projects. It looks for hard-coded API keys, tokens, passwords, and private keys; process execution patterns such as Python subprocess, Node.js child_process, and shell=True; and access to environment variables through patterns such as os.environ and process.env.

The scanner also evaluates MCP-related tool names and descriptions for terms associated with deletion, shells, tokens, secrets, and filesystem access. It checks text for prompt-injection language, including requests to ignore earlier instructions or expose system prompts. Results carry severities from low through critical and can be used as a CI gate.

How it works

Install the Python package from a local checkout, then scan a directory with mcp-scan . or provide a narrower project path. The command can print human-readable text or write JSON, Markdown, or SARIF reports. SARIF is intended for code-scanning workflows, while Markdown can be used in pull-request reports.

A --fail-on threshold makes the command return exit code 1 when findings at that level or above are present. For example, a high threshold fails on high and critical findings. This makes the rob925/mcp-shield MCP server suitable for a GitHub Actions step that installs the package and scans the checked-out repository.

The scanner supports .mcp-scan-ignore files for paths such as tests, fixtures, and deliberately unsafe examples. Individual reviewed findings can also be suppressed on the same source line with a rule ID. The all suppression is documented for test fixtures only.

Setup and configuration

Python 3.10 or newer is required. Install from the repository with pip install ., or run the module directly with python -m mcp_security_scanner.cli . without installing the command-line entry point.

To expose the rob925/mcp-shield MCP server to an MCP client, start mcp-shield-server as a stdio process. A Claude Desktop configuration can register that command under an mcpServers entry.

For CI, add a workflow step that checks out the repository, installs Python, installs the package, and runs mcp-scan . --fail-on high. Select the output format and destination with the corresponding CLI options.

Tools and capabilities

The stdio MCP interface provides two tools:

• scan_path_tool scans a local MCP server or agent project.
• list_rules returns the available rule IDs and their descriptions.

The command-line interface accepts a path, output format, output file, and severity threshold. Supported formats are text, JSON, Markdown, and SARIF. Rule identifiers can be used in inline suppression comments, allowing a reviewed exception to target one finding rather than disabling the complete scan.

Limitations and notes

rob925/mcp-shield is a static heuristic scanner, not a complete security audit. Its documented scope is catching common risks early, so a clean result should not be treated as proof that a project is safe. The roadmap mentions future MCP SDK-aware parsing for Python and TypeScript, additional enterprise rules, and more targeted prompt and resource injection checks; those items should not be assumed to be available now.