Dfx Mcp Scanner

Security scanner for MCP (Model Context Protocol) servers. Detect malicious tools, data exfiltration, and supply chain risks before connecting an MCP server to your AI agent.

PyPI Python 3.10+ License: MIT CI

---

Why MCP Scanner?

MCP servers give AI agents (Claude Code, Cursor, Copilot) direct access to tools, filesystems, and APIs. But nobody is checking if those servers are safe.

MCP Scanner analyzes:

• MCP server config files (Claude Code, Cursor, generic)
• Command-level risks (npx --yes, curl|bash, sudo)
• Secret exposure in environment variables
• Filesystem and network access patterns
• Source code of MCP server implementations (with AgentGuard integration)

Quick Start

pip install dfx-mcp-scanner

# Scan your Claude Code MCP config
mcp-scanner

# Scan a specific config
mcp-scanner ~/.cursor/mcp.json

# JSON output
mcp-scanner .mcp.json --format json

What It Detects

Rule	Severity	Description
Remote code execution	CRITICAL	`curl
Auto-install packages	HIGH	npx --yes without version pinning
Privileged execution	CRITICAL	Server running as root/sudo
Secret exposure	CRITICAL	Real API keys/tokens in config env vars
Host filesystem access	HIGH	Server accessing /etc, /root, /proc
External network access	MEDIUM	Server connecting to non-localhost URLs
Excessive tool count	LOW	Server registering >20 tools

Supported Configs

• Claude Code (~/.claude/claude_code_config.json)
• Cursor (~/.cursor/mcp.json)
• Project-level (.mcp.json)
• Generic MCP server configs

AgentGuard Integration

When AgentGuard is installed, MCP Scanner performs deep source code analysis on MCP server implementations using all 10 OWASP ASI detection rules.

License

MIT - see LICENSE.

---

Built by Dockfix Labs.

---

AgentGuard Ecosystem

AgentGuard is the core security scanner. Companion tools:

Tool	Purpose	Install
agentguard	AI agent code security scanner	pip install dfx-agentguard
mcp-scanner	MCP server security audit	pip install dfx-mcp-scanner
agentguard-app	GitHub App for PR reviews	Install from Marketplace
agentguard-vscode	VS Code inline diagnostics	Install from VS Code
agentguard-benchmark	Detection benchmark suite	git clone
agentguard-demo	Live demo with Code Scanning	git clone

19 detection rules | 102 tests | 50 benchmark samples | OWASP ASI Top 10 GitHub Action: dockfixlabs/agentguard@v1