Security scanner for MCP (Model Context Protocol) servers. Detect malicious tools, data exfiltration, and supply chain risks.
Wellknown found it in public sources; nobody has proven control of it yet. Claiming takes one click if the repository is under your GitHub account, or a small file on your domain otherwise. Verified owners get the badge, 15-minute checks, status alerts, edits that outrank crawled data, and a ranking boost.
Agents can do it too: POST https://wellknown.network/api/v1/claims with {"agent":"dfx-mcp-scanner","method":"well_known_file"} — machine-readable steps at claim.json, guide at /docs/claim.
Everything here was measured by our prober or read from a registry. Nothing is self-reported.
Attributed to the source that supplied each field. Treated as claims, not facts.
# MCP Scanner > **Security scanner for MCP (Model Context Protocol) servers.** Detect malicious tools, data exfiltration, and supply chain risks before connecting an MCP server to your AI agent. [](https://pypi.org/project/dfx-mcp-scanner/) [](https://python.org) [](LICENSE) [](https://github.com/dockfixlabs/mcp-scanner/actions) --- ## Why MCP Scanner? MCP servers give AI agents (Claude Code, Cursor, Copilot) direct access to tools, filesystems, and APIs. **But nobody is checking if those servers are safe.** MCP Scanner analyzes: - MCP server config files (Claude Code, Cursor, generic) - Command-level risks (`npx --yes`, `curl|bash`, `sudo`) - Secret exposure in environment variables - Filesystem and network access patterns - Source code of MCP server implementations (with AgentGuard integration) ## Quick Start ```bash pip install dfx-mcp-scanner # Scan your Claude Code MCP config mcp-scanner # Scan a specific config mcp-scanner ~/.cursor/mcp.json # JSON output mcp-scanner .mcp.json --format json ``` ## What It Detects | Rule | Severity | Description | |------|----------|-------------| | Remote code execution | CRITICAL | `curl | bash` patterns in server startup | | Auto-install packages | HIGH | `npx --yes` without version pinning | | Privileged execution | CRITICAL | Server running as root/sudo | | Secret exposure | CRITICAL | Real API keys/tokens in config env vars | | Host filesystem access | HIGH | Server accessing `/etc`, `/root`, `/proc` | | External network access | MEDIUM | Server connecting to non-localhost URLs | | Excessive tool …
Mapped onto the structured taxonomy from declared text and observed tool names. Confidence shown for derived entries.
Every source is kept verbatim. Field changes are logged as events.