Open-source security testing for MCP servers

See what an attacker can make your MCP server do. Before you ship it.

MCP servers are the connectors that let AI assistants and agents use your tools and data. mcpprobe tests yours the way an attacker would, links every issue to the exact request and response observed, and tells you how to fix it.

v0.3.0
pipx install mcpprobe-scannermcpprobe https://your-server.example/mcp

Package on PyPI · source on GitHub · v0.3.0 release notes

Install the CLISee a sample report

Opt-in only: deeper tests run only on servers you have proven you own. Read-only by default. Scanning policy

4 of 21 findings from one recorded scan

HIGHAUTH-01
MCP07:2025 · ASI03

Remote MCP endpoint accepts requests without authentication

No token was sent and the server listed all 7 of its tools, including run_command.

→ POST /mcp · no Authorization header
{"jsonrpc":"2.0","method":"tools/list","id":3,"params":{}}
← 200 OK · 2.2 ms · ev-0005
{"tools":["add","send_email","note_taker","run_command","bad name!","s3_list","gh_issue"]} (7 tools)
FixPut the endpoint behind OAuth 2.1 as described in the MCP authorization spec: return 401 with WWW-Authenticate pointing at RFC 9728 protected-resource metadata, validate token audience, and reject requests without a valid bearer token. For local servers, bind to 127.0.0.1 and still require a token.
Confidence: highHow AUTH-01 is tested
passive checks in v0.3.0, mapped to OWASP
24
in the full catalogue, 8 active coming soon
37
default request rate, never more than 10
5/s

Source: the scanner's check catalogue v0.3.0, synced , and mcpprobe --help

One scan, start to finish

One command. Every finding, with the proof and the fix.

mcpprobe connects the way an AI client would, runs read-only tests against authentication, tool descriptions, sessions and transports, and records every request and response it relied on. You get a terminal summary, a JSON report and results in GitHub code scanning.

Scan
Read-only by default: it never calls a tool. Deeper tests that do are coming soon and will run only with your written scope.
Verify
Before any deeper test, prove the server is yours with one DNS TXT record at _mcpprobe.<host>, or locally for stdio servers.
Fix
Each finding carries the request, the response and the fix. Re-run in CI until it passes.
How a scan works
Real run against the scanner's deliberately vulnerable test server · recorded · trimmedmcpprobe 0.1.0
$ mcpprobe http://127.0.0.1:8765/mcp mcpprobe 0.1.0 | passive mode | rate 5.0/s | scan only what you own or are authorised to testtransport=http | revision=2025-11-25 (handshake) | auth=none | server=fake-mcp 0.0.1 | tools=7Findings  critical 0   high 8   medium 5   low 3   info 5  HIGH    AUTH-01  Remote MCP endpoint accepts requests without authentication HIGH    META-01  Possible tool-description poisoning HIGH    META-05  Secret material in server metadata or configuration HIGH    TRANS-01 Origin header not validated (DNS-rebinding exposure) HIGH    TRANS-03 Forged session ID accepted MEDIUM  ERR-01   Verbose error responses leak stack traces, paths or versions MEDIUM  META-03  Tool annotations contradict the tool's apparent capability … INJ-01     active  skipped  requires --active and verified ownershipSUPPLY-01  active  skipped  not applicable to http transport38 request/response pairs recorded as evidence.Result: FAIL (findings at or above high)

Why it matters

What goes wrong with MCP servers is already on the record.

An MCP server decides what an AI agent can read, send and change. When it is wrong, the agent, or anyone who can reach the server, can be made to do things you never intended.

  1. A public GitHub issue steered an agent using the GitHub MCP server into leaking private repository data. AuthZed timeline, citing Invariant Labs

  2. An MCP package for sending email added one line that blind-copied every message to an outside address. It had 1,643 downloads before it was removed. The Hacker News, 29 Sep 2025

  3. In a study of 9,695 MCP servers listed in public directories, no authentication was the largest group of the 4,982 issues found: 2,054 of them, or 41%. Trend Micro, 24 Jun 2026

  4. Of the exposed MCP servers Wiz observed, about 70% listed every tool to an anonymous caller. Wiz, 28 Jul 2026

The MCP ecosystem today

The official MCP Registry lists servers and leaves security scanning to the package registries and to aggregators. These are counts of that public metadata, refreshed daily. We have not scanned these servers.

Counts unavailable in this build

The registry could not be reached when this page was generated, so no numbers are shown rather than old or estimated ones. The page tries again every day. When it can, it counts the servers listed, the share that declare a remote endpoint, and how many still offer the deprecated HTTP+SSE transport, which TRANS-04 flags.

Source: official MCP Registry API. Counts of public metadata; the registry is in preview and its data may be reset.

Who it's for

Built for the people who ship, connect and sign off on MCP servers.

MCP server authors
Run one command before every release and fail CI on new issues with the GitHub Action. Once hosted scanning launches, show users a badge that links to the evidence.How the badge is earned
Teams connecting AI agents
Test every MCP server you run before an agent can reach it. Once hosted scanning launches, it re-tests on a schedule and tells you when a tool description changes after you approved it.Plans
Security and compliance
Findings mapped to OWASP's MCP, agentic and LLM Top 10 lists, each linked to the request and response observed, which you can attach to a review or questionnaire.The check catalogue

What it covers

The MCP attack surface, not a generic web scan.

Built on the current MCP spec and the servers people actually run, so it understands tool descriptions, authorization metadata, sessions and transports the way a client does.

Browse all 37 checks
  • AUTH-01..04 · MCP07

    Authentication

    No auth, missing RFC 9728 metadata, no PKCE S256, wrong-audience and query-string tokens

  • META-01..05 · MCP03 · ASI01

    Tool metadata

    Hidden instructions, cross-tool shadowing, invisible Unicode, rug-pull diffs, secrets, lying annotations

  • TRANS-01..05 · MCP07

    Transport

    Origin validation, version handling, session-id quality, deprecated SSE, TLS and headers

  • ERR-01 · DOS-01

    Robustness

    Stack traces in errors; one oversized, one deeply nested and 20 paced requests, never more

  • INJ-01..05 · MCP05 · coming soon

    Injection (active)

    Command, path traversal, SSRF, SQL and tool-output canaries, behind the authorisation gate

  • SUPPLY · SANDBOX · coming soon

    Package and config

    Provenance, risky stdio configs and sandboxed start-up behaviour for stdio packages

Badge and CI

A badge that means something because it expires.

The badge links to a public report page and goes grey after 30 days without a clean scan. Run mcpprobe in GitHub Actions and the SARIF lands in code scanning.

mcpprobepassing · 2d agomcpprobestale · 41d
How the badge is earned
.github/workflows/mcpprobe.yml
- uses: mcpprobe-dev/mcpprobe@v0.3.0
  with:
    target: https://staging.your-server.example/mcp
    fail-on: high
    sarif-output: mcpprobe.sarif
- uses: github/codeql-action/upload-sarif@v3
  if: always()
  with:
    sarif_file: mcpprobe.sarif

How it compares

Other tools exist. Here is where each one fits.

mcpprobe compared with three categories of tool
CapabilitymcpprobeStatic config scannersLLM eval red-teamersEnterprise AI security
Tests the live serverYes, with request and response evidenceReads config and descriptions onlyPrompts, not the MCP protocolYes
MCP authorization spec checksRFC 9728, RFC 8707, PKCE, OriginNoNoVaries
Published false-positive ratePer check, once it has 100 samplesNoNoNo
Price for a 5-person teamFree CLI · £49/month hostedFreeFree tier, cappedQuote only
What it does not doNo runtime proxy, no exploitation, no unverified targets———

Named comparisons, with sources: mcpprobe and mcp-scan · mcpprobe and Cisco mcp-scanner

What shipped

Dated, so you can check.

Check catalogue v0.3.0 synced from the scanner's CHECKS.md on .

Full changelogStatus
  1. Sample report with a PDF

    The demo report runs against a reserved .example host and can be downloaded as a PDF evidence report.

  2. Install as mcpprobe-scanner

    Install commands use the PyPI distribution mcpprobe-scanner. The command is still mcpprobe.

  3. v0.3.0

    First public release of the open-source scanner core: 24 passive checks, the CLI, the GitHub Action and SARIF output.

Your server is already on the internet. Find out what it answers.

Install the CLISee how a scan works