Security scanner, runtime proxy, and audit logger for MCP servers
Wellknown found it in public sources; nobody has proven control of it yet. Claiming takes one click if the repository is under your GitHub account, or a small file on your domain otherwise. Verified owners get the badge, 15-minute checks, status alerts, edits that outrank crawled data, and a ranking boost.
Agents can do it too: POST https://wellknown.network/api/v1/claims with {"agent":"mcp-shield-cli","method":"well_known_file"} — machine-readable steps at claim.json, guide at /docs/claim.
Everything here was measured by our prober or read from a registry. Nothing is self-reported.
Attributed to the source that supplied each field. Treated as claims, not facts.
# MCP Shield [](https://opensource.org/licenses/Apache-2.0) [](https://www.python.org/downloads/) Like [Bandit](https://github.com/PyCQA/bandit) for Python code, but for MCP servers. Security scanner, runtime proxy, and audit logger for [Model Context Protocol](https://modelcontextprotocol.io/) servers. ## Install ```bash pip install mcp-shield-cli ``` Requires Python 3.11+ and Node.js (for npx-based MCP servers). ## Usage ### `mcp-shield test` — scan a server ```bash # Scan a local stdio server mcp-shield test "npx -y @modelcontextprotocol/server-filesystem /tmp" # Scan a remote HTTP server mcp-shield test "http://localhost:8080/mcp" # Run only specific suites (compliance, security, advisory, or all) mcp-shield test "npx server" --suite security mcp-shield test "npx server" --suite security --suite advisory # Pass environment variables to the server process mcp-shield test "npx server" --env API_KEY=sk-123 --env DB_URL=postgres://host/db # Save JSON report to file mcp-shield test "npx server" --output report.json # JSON to stdout (for piping) mcp-shield test "npx server" --format json # SARIF output (for GitHub Code Scanning) mcp-shield test "npx server" --format sarif # SARIF to file (can combine with any --format) mcp-shield test "npx server" --sarif-output report.sarif # Both terminal and JSON output mcp-shield test "npx server" --format both --output report.json # CI mode: exit code 1 if any high+ severity check fails mcp-shield test "npx server" --fail-on high # Enable ML-based poisoning detection (DeBERTa, slower but more accurate) mcp-shield test "npx server" --ml # Set connection/check timeout (default 30s) mcp-shield test "npx server" --timeout 10 ``` Example output: ``` Check | Result | Severity | Message COMP-001 | PASS | critical | Handshake OK COMP-002 | PASS | er…
Mapped onto the structured taxonomy from declared text and observed tool names. Confidence shown for derived entries.
Every source is kept verbatim. Field changes are logged as events.