Security scanner for Model Context Protocol (MCP) with capability graph analysis. Detects emergent attack chains across multi-server AI agent deployments that no individual tool scan can find.
概览
Open-source MCP security scanner with capability graph analysis. The Model Context Protocol (MCP) ecosystem has grown to over 10,000 servers, yet there is no comprehensive security tool to audit them. At least 25 CVEs and disclosure reports have documented vulnerabilities across tool poisoning, prompt injection, SSRF, and auth bypass classes. Existing scanners cover only a fraction of the attack surface and none analyze cross-server attack chains. MCP-Lattice fills that gap. - MCP configurations for Claude Desktop, Cursor, Windsurf, VS Code, and Gemini CLI - covering prompt injection, tool poisoning, code execution, auth bypass, data exfiltration, supply chain, privilege escalation, and DoS - : L1 Pattern matching (<1ms), L2 Semantic analysis (~20ms), L3 Capability graph (~50ms), L4 Causal/LLM (planned) - : terminal table, JSON, SARIF (for CI/CD), and HTML Or download a prebuilt binary from the releases page.
README
以下为原文 README 节选，完整内容请查看原文。
MCP-Lattice
Open-source MCP security scanner with capability graph analysis.
The Problem
The Model Context Protocol (MCP) ecosystem has grown to over 10,000 servers, yet there is no comprehensive security tool to audit them. At least 25 CVEs and disclosure reports have documented vulnerabilities across tool poisoning, prompt injection, SSRF, and auth bypass classes. Existing scanners cover only a fraction of the attack surface and none analyze cross-server attack chains. MCP-Lattice fills that gap.
What MCP-Lattice Does
- Auto-discovers MCP configurations for Claude Desktop, Cursor, Windsurf, VS Code, and Gemini CLI
- 34 detection templates covering prompt injection, tool poisoning, code execution, auth bypass, data exfiltration, supply chain, privilege escalation, and DoS
- 4-layer detection pipeline: L1 Pattern matching (<1ms), L2 Semantic analysis (~20ms), L3 Capability graph (~50ms), L4 Causal/LLM (planned)
- 4 output formats: terminal table, JSON, SARIF (for CI/CD), and HTML
Quick Start
Install
go install github.com/panavinsingh/MCP-Lattice/cmd/mcp-lattice@latest
Or download a prebuilt binary from the releases page.
Run
mcp-lattice scan # auto-discover and scan all MCP servers
mcp-lattice scan --config ~/.config/claude/claude_desktop_config.json # scan a specific config
mcp-lattice scan --format sarif -o results.sarif # SARIF output for CI
mcp-lattice scan --severity high # only high and critical findings
What It Finds
- Tool poisoning with hidden instructions
- Prompt injection via tool descriptions and parameters
- SSRF-prone parameters with no allowlists
- Zero-auth servers exposed to the network
- Toxic tool combinations across servers
- Data exfiltration paths (filesystem to HTTP)
- Privilege escalation through capability chaining
- Supply chain risks in server dependencies
Capability Graph Analysis
MCP-Lattice builds a capability graph across all configured MCP servers, modeling what each tool can read, write, execute, and transmit. It then searches for cross-server attack chains – for example, a filesystem-read tool on one server combined with an HTTP-send tool on another creates an exfiltration path. This is the key differentiator: no other scanner detects multi-server toxic combinations.
Results
We attempted to scan 100 MCP servers from the npm registry (75 scanned successfully, 25 timed out):
| Metric | Value |
|---|
安装
This server does not publish a one-line install command.
Open the repository installation guide 新手？先看 mcpskill.org 教程 →