loading…
Search for a command to run...
loading…
Scans MCP servers for prompt-injection, tool-poisoning, and SSRF vulnerabilities using 30+ canonical rules across 5 severity tiers, with optional signed safety
Scans MCP servers for prompt-injection, tool-poisoning, and SSRF vulnerabilities using 30+ canonical rules across 5 severity tiers, with optional signed safety reports for procurement.
Scan any MCP server for the prompt-injection / tool-poisoning / SSRF class disclosed in the April 2026 CVE wave.
pip install meok-mcp-injection-scan-mcp
April 2026 was a bad month for MCP. Anthropic published a "by-design" MCP RCE class affecting ~7,000 public servers (~150M downloads). mcp-server-git shipped a CVE chain. DockerDash got popped by an injection chain. Tool-description prompt injection ("tool poisoning") was demonstrated against every major MCP host.
If you run an MCP server in production, or you're auditing one before adoption, you need a fast scan that flags the patterns the April 2026 disclosures target. This MCP is that scan.
30+ canonical rules across 5 severity tiers:
additionalProperties=true, unbounded strings, tool-name impersonation.Coverage maps to: OWASP LLM Top 10, GenAI Red Team v1, the April 2026 Anthropic MCP RCE disclosure, and the mcp-server-git CVE chain.
| Tool | Purpose |
|---|---|
scan_mcp_url(url) |
Fetch a remote MCP server's tool listing and scan it |
audit_tool_descriptions(tools_json) |
Scan a pasted JSON tool list (auth-walled servers) |
signed_safety_report(subject, findings_json, score, note) |
Issue a procurement-grade signed cert (Pro tier) |
list_rules() |
Inspect the full rule catalogue before subscribing |
pricing() |
Subscribe links + tier comparison |
| Tier | Price | What you get |
|---|---|---|
| Free | £0 | 5 scans / day, no signed reports |
| Starter | £29/mo | Unlimited scans + signed reports |
| Pro | £79/mo | + scheduled rescans + 48h support |
| Enterprise | £1,499/mo | + custom rule packs + 4h SLA |
Every signed cert lives at https://meok-attestation-api.vercel.app/verify/<cert_id> — auditors and procurement teams confirm without an account.
This is a static-pattern scanner. It does not run dynamic taint analysis, fuzz the server with adversarial inputs, or replace a human red-team. It is the first 80% of the audit, in 5 seconds, for free.
Solo founder. London. 234 MCP packages on PyPI. Live signing infrastructure at meok-attestation-api.vercel.app. Storefront councilof.ai. Get the catalogue: https://meok-attestation-api.vercel.app/catalogue.
pip install meok-mcp-injection-scan-mcp (this package)Добавь это в claude_desktop_config.json и перезапусти Claude Desktop.
{
"mcpServers": {
"meok-mcp-injection-scan-mcp": {
"command": "npx",
"args": []
}
}
}