MCP Server Security Scanning Tool - an LLM-driven autonomous agent for code audit and vulnerability detection
Wellknown found it in public sources; nobody has proven control of it yet. Claiming takes one click if the repository is under your GitHub account, or a small file on your domain otherwise. Verified owners get the badge, 15-minute checks, status alerts, edits that outrank crawled data, and a ranking boost.
Agents can do it too: POST https://wellknown.network/api/v1/claims with {"agent":"aig-mcp-scan","method":"well_known_file"} — machine-readable steps at claim.json, guide at /docs/claim.
Everything here was measured by our prober or read from a registry. Nothing is self-reported.
Attributed to the source that supplied each field. Treated as claims, not facts.
# MCP-Scan English | **[中文](./README_zh.md)** Command usage: [USAGE.md](./USAGE.md) · [中文](./USAGE_zh.md) > An AI Agent-driven automated MCP Server security scanning and vulnerability detection tool, developed by Tencent Zhuque Lab. ## ✨ Features - **🤖 Intelligent Agent System**: Supports single-stage (fast code audit) and three-stage (Info Collection → Code Audit → Vulnerability Review) scanning modes - **🔍 Deep Code Analysis**: Automatically identifies project structure, tech stack, and potential security vulnerabilities - **📊 SARIF 2.1.0 Output**: CLI mode outputs SARIF 2.1.0 JSON by default, natively consumable by GitHub Code Scanning, Azure DevOps, VS Code, and more - **🔌 AIG Platform Integration**: Interactive scanning via the Web UI with real-time three-stage pipeline results - **🎯 Dedicated Model Configuration**: Configure specialized LLMs for different tasks (thinking, coding, fast response, etc.) - **📊 Security Scoring System**: Automatically calculates project security scores and risk levels - **🛠️ Extensible Tool System**: Easily add custom tools and features - **📝 Detailed Logging**: Full execution process logged with loguru - **🐛 Debug Mode**: Integrated Laminar tracing for easy debugging - **🕵️ Agent Skill Auditing**: Automatically detects and audits Agent Skill project consistency (SKILL.md vs code implementation) - **⚡ Static Pre-scan**: Regex-based scanning for high-risk patterns (curl|bash, cloud metadata, credential theft, etc.) before Agent launch, generating prompt injection context ## 🚀 Quick Start ### Install from PyPI ```bash pip install aig-mcp-scan aig-mcp-scan --repo ./myproject -o result.sarif.json ``` The flags below are the same when the command is `aig-mcp-scan` instead of `python main.py`. ### 1. Clone the Project ```bash git clone <your-repo> cd mcp-scan ``` ### 2. Install Dependencies Recommended using `uv` (faster, auto-manages virtual environments): ```bash uv sync ``` Or using pip: ```bash pip install…
Mapped onto the structured taxonomy from declared text and observed tool names. Confidence shown for derived entries.
Every source is kept verbatim. Field changes are logged as events.