{"$schema":"https://wellknown.network/schemas/agent-record-v1.json","schemaVersion":"1","id":"ag_j5negv646hmw","handle":"aig-mcp-scan","url":"https://wellknown.network/agents/aig-mcp-scan","links":{"self":"https://wellknown.network/agents/aig-mcp-scan/record.json","html":"https://wellknown.network/agents/aig-mcp-scan","markdown":"https://wellknown.network/agents/aig-mcp-scan/record.md","api":"https://wellknown.network/api/v1/agents/aig-mcp-scan","status":"https://wellknown.network/api/v1/agents/aig-mcp-scan/status","claim":"https://wellknown.network/agents/aig-mcp-scan/claim","claimApi":"https://wellknown.network/api/v1/claims","claimDescriptor":"https://wellknown.network/agents/aig-mcp-scan/claim.json","badge":"https://wellknown.network/agents/aig-mcp-scan/badge.svg","openapi":"https://wellknown.network/openapi.json","history":"https://wellknown.network/api/v1/agents/aig-mcp-scan/history","tools":"https://wellknown.network/api/v1/agents/aig-mcp-scan/tools"},"ard":{"identifier":"urn:air::server:aig-mcp-scan","type":"application/mcp-server-card+json"},"kind":"mcp_server","declared":{"name":"aig-mcp-scan","summary":"MCP Server Security Scanning Tool - an LLM-driven autonomous agent for code audit and vulnerability detection","description":"# MCP-Scan\n\nEnglish | **[中文](./README_zh.md)**\n\nCommand usage: [USAGE.md](./USAGE.md) · [中文](./USAGE_zh.md)\n\n> An AI Agent-driven automated MCP Server security scanning and vulnerability detection tool, developed by Tencent Zhuque Lab.\n\n## ✨ Features\n\n- **🤖 Intelligent Agent System**: Supports single-stage (fast code audit) and three-stage (Info Collection → Code Audit → Vulnerability Review) scanning modes\n- **🔍 Deep Code Analysis**: Automatically identifies project structure, tech stack, and potential security vulnerabilities\n- **📊 SARIF 2.1.0 Output**: CLI mode outputs SARIF 2.1.0 JSON by default, natively consumable by GitHub Code Scanning, Azure DevOps, VS Code, and more\n- **🔌 AIG Platform Integration**: Interactive scanning via the Web UI with real-time three-stage pipeline results\n- **🎯 Dedicated Model Configuration**: Configure specialized LLMs for different tasks (thinking, coding, fast response, etc.)\n- **📊 Security Scoring System**: Automatically calculates project security scores and risk levels\n- **🛠️ Extensible Tool System**: Easily add custom tools and features\n- **📝 Detailed Logging**: Full execution process logged with loguru\n- **🐛 Debug Mode**: Integrated Laminar tracing for easy debugging\n- **🕵️ Agent Skill Auditing**: Automatically detects and audits Agent Skill project consistency (SKILL.md vs code implementation)\n- **⚡ Static Pre-scan**: Regex-based scanning for high-risk patterns (curl|bash, cloud metadata, credential theft, etc.) before Agent launch, generating prompt injection context\n\n## 🚀 Quick Start\n\n### Install from PyPI\n\n```bash\npip install aig-mcp-scan\naig-mcp-scan --repo ./myproject -o result.sarif.json\n```\n\nThe flags below are the same when the command is `aig-mcp-scan` instead of `python main.py`.\n\n### 1. Clone the Project\n\n```bash\ngit clone <your-repo>\ncd mcp-scan\n```\n\n### 2. Install Dependencies\n\nRecommended using `uv` (faster, auto-manages virtual environments):\n\n```bash\nuv sync\n```\n\nOr using pip:\n\n```bash\npip install…","publisher":null,"homepage":"https://github.com/Tencent/AI-Infra-Guard/tree/main/mcp-scan","repository":"https://github.com/Tencent/AI-Infra-Guard/issues","version":"0.2.0","license":"Apache-2.0","protocols":["mcp"],"tags":["ai-security","mcp","model-context-protocol","red-team","llm","audit","vulnerability","ai-infra-guard"],"pricing":null,"endpoints":[{"url":"pypi:aig-mcp-scan","type":"package_pypi","auth":null,"probeable":false}],"skills":null,"tools":null,"extra":null,"attribution":{"kind":"pypi","name":"pypi","license":"pypi","repoUrl":"pypi","summary":"pypi","version":"pypi","description":"pypi","homepageUrl":"pypi"}},"derived":{"capabilities":[{"slug":"code.security-review","name":"Security Review","confidence":1,"provenance":"declared"},{"slug":"security.scanning","name":"Security Scanning","confidence":0.917,"provenance":"derived"},{"slug":"dev.package-management","name":"Packages & Dependencies","confidence":0.825,"provenance":"derived"},{"slug":"code.debugging","name":"Debugging","confidence":0.802,"provenance":"derived"},{"slug":"dev.ci-cd","name":"CI/CD & Deploy","confidence":0.756,"provenance":"derived"},{"slug":"dev.version-control","name":"Version Control","confidence":0.745,"provenance":"derived"}],"categories":["code","dev","security"],"language":"en"},"observed":{"status":"unknown","statusReason":"Distributed as a package to run locally; no network endpoint to check.","lastOkAt":null,"lastProbedAt":null,"statusComputedAt":null,"reliability30d":null,"latestObservations":[],"tools":null,"package":{"name":"aig-mcp-scan","registry":"pypi","observedAt":"2026-11-02T20:26:36.052Z","publishedAt":"2026-10-27T02:24:04.202467Z","latestVersion":"0.2.0"},"toolSurface":null,"endpointFacts":[]},"verification":{"claimed":false,"claimedAt":null,"proofs":[]},"provenance":{"sources":[{"source":"pypi","key":"aig-mcp-scan","url":"https://pypi.org/project/aig-mcp-scan/","firstSeenAt":"2026-10-27T18:27:09.224Z","fetchedAt":"2026-11-02T20:25:49.694Z","normalizedAt":"2026-11-02T20:25:49.694Z"}]},"firstSeenAt":"2026-10-27T18:27:09.224Z","updatedAt":"2026-11-02T20:26:36.052Z"}