Enhancement Request - Scan MCP Servers Independently From Setup

[HarelMil]

First of all, thank you for the great work.

It would be invaluable to scan an MCP server before setting one up to identify potential security issues and risks.
This feature would allow a user to decide if an MCP server is presumably safe to consume and not to scan after the fact.

[lbeurerkellner]

Interesting, I like the idea. So you would like to pass e.g. an npx or uvx string like some-server@latest before actually installing it.

Is that the right understanding?

Something like:

mcp-scan npx some-server@latest

[sbehrens]

+1 to @HarelMil. My general worry is when users download MCP services directly from the Cline store. The process is that a user selects the MCP service, it's git cloned and built, and then the "args" are added to the MCP JSON file. At that point, if the tool contains malware, it may have already been instrumented as pre- or post-install steps.

Building slightly, I've been working on SemGrep rules to detect Malware/data exfil on top of tool poisoning signatures for MCPs since I think both vectors are relevant. Long term it may be valuable to expand MCP scanning to a broader set of malware/data theft.

[HarelMil]

Interesting, I like the idea. So you would like to pass e.g. an npx or uvx string like some-server@latest before actually installing it.

Is that the right understanding?

Something like:

mcp-scan npx some-server@latest

Of course, it may differ between MCP servers, as some are executed differently (e.g., uvx, npx, direct binary execution).
Still, we could build and install an MCP server in an isolated environment (e.g., Docker) and then run the tests; this could be ideal.

To connect with what @sbehrens said, the implementation as of now would likely only find MCP protocol-related issues but would miss arbitrary malicious behavior. Such behavior would need to be assessed separately, similar to how any open-source software is typically vetted for malicious intentions.

[razashariff]

Pre-install verification is the right direction. MCPS (MCP Secure) provides this via cryptographic attestation — MCP servers and their tool definitions can be signed with ECDSA P-256 before deployment. A client verifies the signature and hash before connecting, ensuring the server has not been tampered with since it was attested.

This is complementary to agent-scan's behavioral analysis — cryptographic verification confirms the tool definition is exactly what was signed (bit-for-bit via SHA-256), while behavioral scanning catches semantic risks in the definition itself.

Published as an IETF Internet-Draft and on npm as mcp-secure (zero dependencies). Trust Authority & scanner: agentsign.dev