MCP Guard

Security scanner for MCP servers — audit capabilities, detect risks, generate security reports.

Why

The MCP ecosystem exploded (67,000+ servers in 18 months), but security hasn’t kept up:

• 87% of MCP servers fail high-trust thresholds
• 72% expose sensitive capabilities unnecessarily
• 53% rely on static API keys

MCP Guard helps you audit MCP servers before connecting agents to them.

Install

pip install mcp-guard

Quick Start

# Scan an MCP server directory
mcp-guard scan ./my-mcp-server

# Scan a specific config file
mcp-guard scan ./mcp.json

# Output as JSON
mcp-guard scan ./my-mcp-server --format json

# Output as SARIF (for GitHub Code Scanning)
mcp-guard scan ./my-mcp-server --format sarif --output results.sarif

# Fail CI if HIGH or CRITICAL findings
mcp-guard scan ./my-mcp-server --fail-on high

# Show server info without scanning
mcp-guard info ./my-mcp-server

What It Detects

Example Output

MCP Server
test-server v1.0.0
A test MCP server

Risk Score: CRITICAL

Summary
Total Capabilities    3
Critical              1
High                  1
Medium                0
Low                   0

Findings
Rule      Level       Capability          Message                              Suggestion
MCP002    CRITICAL    delete_database     Destructive operation without auth    Add authentication
MCP001    HIGH        create_user         Write operation without auth         Add authentication

CI Integration

GitHub Action

name: MCP Security Scan
on: [push, pull_request]
jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.11"
      - run: pip install mcp-guard
      - run: mcp-guard scan ./mcp-server --format sarif --output results.sarif
      - uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: results.sarif

License

MIT