一款用于扫描MCP（模型上下文协议）服务器和潜在安全发现工具的Python工具。MCP扫描器结合了Cisco AI Defense检测API、YARA规则和基于LLM的分析，用于检测恶意MCP工具。

概述

MCP 扫描器为扫描 MCP 服务器和安全发现工具提供了全面的解决方案。它利用三种强大的扫描引擎（Yara、基于大型语言模型的分析、思科 AI 防御），可单独使用或单独使用。

该SDK设计简便，同时提供强大的扫描功能、灵活的认证选项和定制化功能。

特色

• 多种模式： 将扫描器作为独立的CLI工具或REST API服务器运行
• 多引擎安全分析：根据需求，可同时或单独使用三种扫描引擎。
• 易受攻击包扫描：利用pip审计集成扫描已知漏洞（CVE/PYSEC/GHSA）的Python依赖。
• 准备度扫描：对生产准备问题（超时、重试、错误处理）进行零依赖静态分析。

MCP Scanner

A Python tool for scanning MCP (Model Context Protocol) servers and tools for potential security findings. The MCP Scanner combines Cisco AI Defense inspect API, YARA rules and LLM-based analysis to detect malicious MCP tools.

Overview

The MCP Scanner provides a comprehensive solution for scanning MCP servers and tools for security findings. It leverages three powerful scanning engines (Yara, LLM-based analysis, Cisco AI Defense) that can be used together or independently.

The SDK is designed to be easy to use while providing powerful scanning capabilities, flexible authentication options, and customization.

Features

• Multiple Modes: Run scanner as a stand-alone CLI tool or REST API server
• Multi-Engine Security Analysis: Use all three scanning engines together or independently based on your needs.
• Vulnerable Packages Scanning: Scan Python dependencies for known vulnerabilities (CVE/PYSEC/GHSA) using pip-audit integration.
• Readiness Scanning: Zero-dependency static analysis for production readiness issues (timeouts, retries, error handling).
• Comprehensive Scanning: Scan MCP tools, prompts, resources, and server instructions for security findings
• Behavioural Code Scanning: Scan Source code of MCP servers for finding threats.
• VirusTotal Binary Scanning: Automatically detect malware in binary files (images, PDFs, executables, archives) bundled with MCP servers using VirusTotal hash lookups.
• PyPI Package Scanning: Download and scan PyPI packages inside a Docker sandbox with behavioral analysis.
• Behavioural Code Scanning: Scan Source code of MCP servers for detecting threats.
• Static/Offline Scanning: Scan pre-generated JSON files without live server connections - perfect for CI/CD pipelines and air-gapped environments
• Explicit Authentication Control: Fine-grained control over authentication with explicit Auth parameters.
• OAuth Support: Full OAuth authentication support for both SSE and streamable HTTP connections.