MCPeek

npm version npm downloads License: MIT

Source-code security scanner for MCP (Model Context Protocol) server implementations.

Unlike config/runtime scanners, mcpeek reads your source code and detects vulnerabilities at the AST level — understanding MCP SDK patterns like server.tool() and server.setRequestHandler() and tracking taint from handler parameters to dangerous sinks.

Quick start

# Scan a GitHub repo
npx mcpeek scan https://github.com/org/your-mcp-server

# Scan a local directory
npx mcpeek scan ./my-mcp-server

# Run only specific rules
npx mcpeek scan ./my-server --rules command-injection,sql-injection

# CI mode (exit 1 on high+ severity findings)
npx mcpeek scan ./my-server --ci --fail-on high

# Output as SARIF (GitHub Code Scanning compatible)
npx mcpeek scan ./my-server --format sarif --output findings.sarif

Scan options

Detection rules

Each finding includes a taintChain showing how user input reaches the sink — e.g. cmd (handler param) → command (line 3) → execSync() (line 5).

Batch audit

# Scan all servers in a targets file
npx mcpeek audit --targets targets/top-30.json --output results/

The bundled targets/top-30.json lists verified TypeScript MCP servers and is what we use for the project's own corpus runs.

Output formats

--format markdown (default), json, or sarif. SARIF 2.1.0 output includes codeFlows derived from the taint chain, so findings render in GitHub Code Scanning with the full path from parameter to sink.

Install

npm install -g mcpeek
# or one-shot
npx mcpeek scan <target>

Use in CI

Run MCPeek directly with npx in any GitHub Actions workflow:

- uses: actions/checkout@v4
- uses: actions/setup-node@v4
  with:
    node-version: "20"
- run: npx mcpeek scan . --ci --fail-on high

To upload findings to GitHub Code Scanning, emit SARIF and hand it to upload-sarif (the job needs security-events: write):

permissions:
  contents: read
  actions: read
  security-events: write

steps:
  - uses: actions/checkout@v4
  - uses: actions/setup-node@v4
    with:
      node-version: "20"
  - run: npx mcpeek scan . --format sarif --output mcpeek.sarif
  - uses: github/codeql-action/upload-sarif@v3
    if: always()
    with:
      sarif_file: mcpeek.sarif

License

MIT