syedanas01/mcp-safeguard

---

30-Second Demo

pip install mcp-safeguard
git clone https://github.com/SyedAnas01/mcp-safeguard && cd mcp-safeguard
mcp-safeguard scan examples/demo-vulnerable-config.json

┌─────────────────────────────────────────────────┐
│  mcp-safeguard  —  MCP Security Scanner         │
│  github.com/SyedAnas01/mcp-safeguard            │
└─────────────────────────────────────────────────┘

Scanning: examples/demo-vulnerable-config.json
────────────────────────────────────────────────────────────
  [CRITICAL]  CRED-007  AWS Access Key ID
              Location: env.AWS_ACCESS_KEY_ID
              Evidence: AKIA************MPLE
              CVSS:     9.9
              Fix:      Rotate AWS credentials. Use IAM roles.

  [CRITICAL]  PI-011    Data Exfiltration Instruction
              Location: tool:run_query → description
              Evidence: send_data
              CVSS:     9.5
              Fix:      Immediately audit — designed to exfiltrate data.

  [HIGH]      TP-002    Covert Operation Descriptor
              Location: tool:summarize_document.description
              Evidence: |MCP over SSE/stdio| D
    D --> E & F & G
    E --> M --> N --> O
    E --> H & I & J & K & L
    H & I & J & K & L --> Q & R

---

Why This Matters

External research confirms the threat is real: MCPTox (2025) found a 72% attack success rate across 45 production MCP servers, demonstrating that tool poisoning and prompt injection attacks are actively exploitable in today’s MCP ecosystem.

OWASP officially added MCP Tool Poisoning to their 2026 threat guidance — the same vulnerability category mcp-safeguard’s TP-* rules detect.

The gap: The MCP ecosystem grew from zero to 10,000+ servers in 18 months while security tooling lagged behind. mcp-safeguard is an open-source scanner built specifically for MCP’s attack surface — tool definitions, server configs, and SSRF exposure via prompt injection.

The vulnerability patterns mcp-safeguard detects are documented with illustrative examples in SECURITY-HALL-OF-SHAME.md. Run mcp-safeguard on your own servers and contribute real scan results via GitHub Issues or Discussions.

Share your results — open a Discussion or submit a PR to SECURITY-HALL-OF-SHAME.md.

---

Project Resources & Standards Work

📰 Community & Standards

• Hacker News — “MCP-safeguard: Security scanner for MCP servers” (2026-05-22)
• IETF Internet-Draft — draft-mohiuddin-mcp-security-considerations-00, security considerations for the Model Context Protocol
• OWASP MCP Top 10 — Open PR adding an SSRF prevention/detection recommended control (PR #42, under review)

🔒 Real-World Fixes Credited

• googleapis/mcp-toolbox — SSRF via redirect chain (CWE-918, fix in PR #3448, reported by Syed Anas Mohiuddin) — credited with CVE-2026-14540
• github/github-mcp-server — GitHub token was attached to requests regardless of destination host; fix in PR #3056, merged 2026-08-18, authored by Syed Anas Mohiuddin

Using mcp-safeguard in your pipeline, or found a real issue with it? We welcome scan results and contributions — open a Discussion or PR.

---

Roadmap

• [x] v0.2 — Tool poisoning detection; CVSS scoring; JSON + Markdown output; batch scanning
• [x] v0.3 — SSRF detection module (SS-001–003); MCP server dog-fooding
• [ ] v0.4 — Scan over MCP stdio transport directly; VS Code extension; GitHub Actions plugin
• [ ] v0.5 — AI-assisted remediation (Claude generates fixes); SBOM for tool supply chain
• [ ] v1.0 — SOC2/compliance report templates; MCP registry bulk scanning

---

Contributing

git clone https://github.com/SyedAnas01/mcp-safeguard
cd mcp-safeguard
python -m venv .venv && source .venv/bin/activate
pip install -e ".[dev]"
pytest tests/ -v

Issues and PRs welcome — especially:

• New injection patterns you’ve seen in the wild
• Credential types not yet covered
• Integrations with other MCP clients
• Scan results from your own MCP servers (add to SECURITY-HALL-OF-SHAME.md)
• OWASP MCP Top 10 rule mappings

---

License

MIT — see LICENSE.

---