适用于MCP（模型上下文协议）服务器和代理技能的安全扫描器

概述

Nova Proximity 扫描 MCP（模型上下文协议）服务器和代理技能，以发现工具、提示和资源。它通过 NOVA 规则对服务器能力进行详细分析和安全评估，以检测提示注入、越狱尝试和可疑代码模式等潜在安全问题。

主要特色

• MCP 服务器扫描：带完整参数分析的发现工具、提示和资源
• 代理技能分析：全面的技能概述、结构、权限与安全性
• NOVA安全规则：基于模式的安全分析及LLM评估
• MCP 规范 2025-11-25：全面支持，包括可流式 HTTP、会话管理和工具注释
• 模式特定修复：针对每个安全发现的可操作指导

快速启动

安装

NOVA安全分析设置

更多详情请参阅NOVA文档：https://docs.novahunting.ai/

用途

指挥结构

常见选项

Nova Proximity - MCP and Skills Security Scanner

Overview

Nova Proximity scans MCP (Model Context Protocol) servers and Agent Skills to discover tools, prompts, and resources. It provides detailed analysis of server capabilities and security evaluation using NOVA rules to detect potential security issues like prompt injection, jailbreak attempts, and suspicious code patterns.

Key Features

• MCP Server Scanning: Discover tools, prompts, and resources with full parameter analysis
• Agent Skills Analysis: Comprehensive skill overview, structure, permissions, and security
• NOVA Security Rules: Pattern-based security analysis with LLM evaluation
• MCP Spec 2025-11-25: Full support including Streamable HTTP, session management, and tool annotations
• Pattern-Specific Remediation: Actionable guidance for each security finding

Quick Start

# Clone and setup
git clone https://github.com/fr0gger/nova-proximity.git
cd nova-proximity
pip install -r requirements.txt

# MCP server - tools and prompt discovery
python novaprox.py http://localhost:8000

# MCP security scan (requires nova-hunting)
python novaprox.py http://localhost:8000 -n -r my_rule.nov

# Agent Skills - scan for security issues
python novaprox.py --skill /path/to/skill -n -r skill_rules.nov

Installation

git clone https://github.com/fr0gger/nova-proximity.git
cd nova-proximity
pip install -r requirements.txt

NOVA Security Analysis Setup

# Install Nova dependencies
pip install nova-hunting

# Set API key (choose one depending on the model you want to use)
export OPENAI_API_KEY="your-openai-key"
export GROQ_API_KEY="your-groq-key"
export ANTHROPIC_API_KEY="your-anthropic-key"
export AZURE_OPENAI_API_KEY="your-azure-key"
export AZURE_OPENAI_ENDPOINT="https://your-resource.openai.azure.com/"

# For Ollama, the default host is used (http://localhost:11434) but you can override it if needed
export OLLAMA_HOST="http://localhost:11434"