Security audit framework for MCP (Model Context Protocol) servers
Wellknown found it in public sources; nobody has proven control of it yet. Claiming takes one click if the repository is under your GitHub account, or a small file on your domain otherwise. Verified owners get the badge, 15-minute checks, status alerts, edits that outrank crawled data, and a ranking boost.
Agents can do it too: POST https://wellknown.network/api/v1/claims with {"agent":"mcp-shield-audit","method":"well_known_file"} — machine-readable steps at claim.json, guide at /docs/claim.
Everything here was measured by our prober or read from a registry. Nothing is self-reported.
Attributed to the source that supplied each field. Treated as claims, not facts.
<p align="center"> <h1 align="center">MCP Shield</h1> <p align="center"> <strong>Security audit framework for MCP servers — before you install them.</strong> </p> <p align="center"> <a href="https://pypi.org/project/mcp-shield-audit/"><img src="https://img.shields.io/pypi/v/mcp-shield-audit?color=blue&label=PyPI" alt="PyPI"></a> <a href="https://github.com/GaboITB/mcp-shield/actions"><img src="https://img.shields.io/github/actions/workflow/status/GaboITB/mcp-shield/ci.yml?label=CI" alt="CI"></a> <a href="https://github.com/GaboITB/mcp-shield/blob/master/LICENSE"><img src="https://img.shields.io/github/license/GaboITB/mcp-shield" alt="License"></a> <img src="https://img.shields.io/pypi/pyversions/mcp-shield-audit" alt="Python"> <img src="https://img.shields.io/badge/dependencies-0-brightgreen" alt="Zero deps"> </p> </p> --- MCP Shield scans MCP (Model Context Protocol) servers **before installation** to detect supply chain attacks, prompt injection, tool poisoning, and rug pulls. It analyzes source code, MCP metadata, and runtime behavior across **3 detection surfaces** with **17 detectors**, **359 tests**, and **zero dependencies**. Battle-tested on **31+ real-world MCP servers**. > **Why?** MCP servers run with your AI agent's permissions. A malicious MCP can exfiltrate your codebase, inject prompts, or run arbitrary commands — all while appearing legitimate. MCP Shield catches these threats *before* they reach your agent. ## Quick Start ```bash pip install mcp-shield-audit # Scan a GitHub repo mcp-shield scan https://github.com/user/mcp-server # Scan all your installed MCPs at once mcp-shield scan --all # Full audit: static + live protocol + Docker sandbox + bait-and-switch mcp-shield scan https://github.com/user/mcp-server --full ``` **Example output:** ``` +== MCP Shield ==========================================+ | my-mcp 12 tools Grade: B Score: 37 | | Criti…
Mapped onto the structured taxonomy from declared text and observed tool names. Confidence shown for derived entries.
Every source is kept verbatim. Field changes are logged as events.