Security scanner for Model Context Protocol (MCP) servers
Wellknown found it in public sources; nobody has proven control of it yet. Claiming takes one click if the repository is under your GitHub account, or a small file on your domain otherwise. Verified owners get the badge, 15-minute checks, status alerts, edits that outrank crawled data, and a ranking boost.
Agents can do it too: POST https://wellknown.network/api/v1/claims with {"agent":"velox-mcp-audit","method":"well_known_file"} — machine-readable steps at claim.json, guide at /docs/claim.
Everything here was measured by our prober or read from a registry. Nothing is self-reported.
Attributed to the source that supplied each field. Treated as claims, not facts.
# mcp-audit > Security scanner for Model Context Protocol (MCP) servers. [](https://github.com/veloxlabsio/mcp-audit) [](https://www.python.org/) [](LICENSE) > **Renamed from `mcp-scan` → `mcp-audit` in April 2026** to avoid collision with Snyk's Agent Scan (formerly Invariant Labs' mcp-scan). The old PyPI package `velox-mcp-scan` is deprecated; install `velox-mcp-audit` instead. **mcp-audit** is an open-source CLI that inspects MCP servers for known security issues. It connects to a server via stdio, fetches its tool/resource/prompt manifest, and runs a battery of checks against the metadata. > **Early alpha.** Currently ships 6 checks: 2 protocol-level (prompt injection markers, ANSI/control character smuggling) and 4 source-code AST checks (path traversal, shell injection, SSRF sinks, hardcoded secrets). 19 more are planned — see [`docs/checks.md`](docs/checks.md) for the full roadmap. Only stdio transport is implemented; HTTP/SSE is planned. Built by [Velox Labs](https://veloxlabs.dev) — an AI security and platform engineering studio. --- ## What it catches today **Protocol-level checks** (run against any MCP server, no source access needed): | Check | Severity | What it detects | |---|---|---| | **MCPA-001** | Critical | Prompt-injection markers in tool descriptions (imperative verbs, `<system>` tags, exfiltration phrases) | | **MCPA-002** | High | ANSI escape sequences, C0 control chars, and zero-width characters hiding payloads in tool descriptions | **Source-code AST checks** (require `--source <path>` pointing at the server's Python source): | Check | Severity | What it detects | |---|---|---| | **MCPA-010** | Critical | Path traversal in file handlers — `open()`/`read_text()` without `is_relative_to()` containment (`resolve()` a…
Mapped onto the structured taxonomy from declared text and observed tool names. Confidence shown for derived entries.
Every source is kept verbatim. Field changes are logged as events.