Security posture scanner for remote MCP servers: OAuth, transport and tool surface, with spec-cited findings and SARIF.
Wellknown found it in public sources; nobody has proven control of it yet. Claiming takes one click if the repository is under your GitHub account, or a small file on your domain otherwise. Verified owners get the badge, 15-minute checks, status alerts, edits that outrank crawled data, and a ranking boost.
Agents can do it too: POST https://wellknown.network/api/v1/claims with {"agent":"mcp-posture","method":"well_known_file"} — machine-readable steps at claim.json, guide at /docs/claim.
Everything here was measured by our prober or read from a registry. Nothing is self-reported.
Attributed to the source that supplied each field. Treated as claims, not facts.
# mcp-posture [](https://github.com/batou9150/mcp-posture/actions/workflows/ci.yml) [](https://github.com/batou9150/mcp-posture/actions/workflows/action-selftest.yml) [](https://pypi.org/project/mcp-posture/) [](LICENSE) **Security posture scanner for remote MCP servers.** Point it at a Streamable HTTP endpoint and it audits the OAuth setup (MCP Authorization spec, RFC 9728, RFC 8414, PKCE, RFC 8707, Client ID Metadata Documents), transport hardening and the tool surface (poisoning, shadowing, rug pulls), with spec-cited findings and CI-native output (SARIF, JSON, Markdown). > Only scan servers you own or are authorized to test. ## Why Most MCP scanners inspect local client configs and stdio servers. `mcp-posture` focuses on **remote** servers and what an attacker sees from the outside before logging in: how the server challenges, which authorization server it trusts, whether that server enforces PKCE S256, whether tokens are audience-bound, whether the tool descriptions hide instructions. Every finding cites the spec section and the MCP revision it applies to (`2025-03-26` through `2026-07-28`). ## Quickstart ```bash # no install needed (or: pipx install mcp-posture / uv tool install mcp-posture) uvx mcp-posture scan https://mcp.example.com/mcp # machine-readable outputs, fail the build on high or worse mcp-posture scan https://mcp.example.com/mcp --sarif results.sarif --markdown summary.md --fail-on high # lint your own client's Client ID Metadata Document mcp-posture cimd lint https://app.example.com/oauth/client.json # scan every remote server declared in your MCP clients (.mcp.json, Claude, VS Code, Cursor, Windsurf) mcp-posture discover mcp-pos…
Mapped onto the structured taxonomy from declared text and observed tool names. Confidence shown for derived entries.
Every source is kept verbatim. Field changes are logged as events.