Open-Source MCP Security

Is Your MCP Setup
Production Ready?

Scan your MCP server configurations for security vulnerabilities, misconfigurations, and known CVEs. Free, open-source, instant results.

6 Security Checks
3 CVEs Tracked
A-F Grading
Open Source
Scan Now ★  View on GitHub
Scroll
01 — Scanner

Scan Your Configuration

Paste your Claude Desktop or MCP config JSON, or enter a server URL, for an instant security grade.

Paste Config
Scan URL
claude_desktop_config.json
02 — What We Check

Six Security Dimensions

AUTH001

Authentication Gaps

Detect MCP servers running with missing authentication, plaintext HTTP transport, and publicly exposed endpoints without credential enforcement.

CRED001

Credential Exposure

Find hardcoded API keys, bearer tokens, and passwords embedded directly in your MCP server configurations before attackers do.

TRANS001

Transport Security

Flag unencrypted channels, sudo privilege escalation, direct shell access, and deprecated or insecure transport types in your stack.

PERM001

Over-Permissioning

Identify servers running with elevated privileges, admin flags, or overly broad filesystem and network access patterns beyond least-privilege.

HYGN001

Config Hygiene

Catch placeholder values, duplicate server entries, empty configurations, and structural complexity risks that increase your attack surface.

CVE001

Known CVEs

Match your MCP packages against a curated database of known vulnerabilities, including CVE-2025-6514 (CVSS 9.6) and two additional critical CVEs.

03 — Install

Install the CLI

terminal
$ pip install mcpshield $ mcpshield scan ~/Library/Application\ Support/Claude/claude_desktop_config.json ─── MCP Shield Security Scan ────────────────── ╭─── Security Grade ────────────────────────╮ │ B │ │ Score: 85 / 100 │ │ Server: my-server │ ╰───────────────────────────────────────────╯ ✓ 1 finding (high)

Works with Claude Desktop, Cursor, and any MCP config format.

04 — API

REST API

Full API documentation available at /docs. Integrate MCP Shield directly into your CI/CD pipeline or security tooling.

$ curl -X POST https://mcpshield.timolabs.dev/api/v1/scan \ -H "Content-Type: application/json" \ -d '{"config": {"mcpServers": {"my-server": {"command": "npx"}}}}' # Returns: grade, score, findings[], remediation steps
Open Source

Open Source. Free Forever.

MCP Shield is MIT-licensed and fully open source. Install the CLI, use the web scanner, or self-host. Star us on GitHub to stay updated on new CVEs and checks.

★  Star on GitHub Scan Now

Built by TimoLabs