scan_mcp_serverLABSCO SUMMARY
Found a real CVE, and is honest about what its source mode cannot prove.
It reported CVE-2026-14540, a server-side request forgery in Google's official MCP Toolbox, and Google shipped the fix — that is a stronger credential than any feature list. The source-tree mode is labelled heuristic: regex over source text, not type-aware analysis, so findings are leads to confirm by reading the cited file and line. It was validated against 14 published vendor MCP servers and identified the target pattern in 9 of 10 known instances.
What it is
A security scanner purpose-built for MCP. Tool descriptions are text the model reads and acts on, so an attacker who controls one can embed instructions; this audits server configs and tool definitions for that and for the rest of the attack surface, with CVSS-scored findings and a remediation line on each.
What you get
- A full scan of an MCP server — injection, credentials, endpoints and tools together —
scan_mcp_server - Tool JSON analysed for injection and poisoning —
scan_tool_definitions; server config audited for credential exposure and OAuth scope risk —check_auth_config - Exposed admin and debug endpoints and dangerous ports probed —
check_endpoint_exposure - Reports in HTML, JSON or text, past scans listed, and two scans diffed for regressions —
generate_security_report,get_scan_history,compare_scans - Rule families with published IDs — credentials (CRED-), endpoint exposure (EP-), tool poisoning (TP-001 through TP-011), and SSRF (SS-001 through SS-003) covering URL parameters with no allowlist, blind fetch descriptors, and redirect-following without revalidation
- A source-tree mode for code-level issues a config scan cannot see —
mcp-safeguard scan-sourcewith rules SRC-001 through SRC-004, covering credentials re-applied across redirects, string-only read-only enforcement, and a server-held credential attached to a caller-influenced host - Resources —
security://reports/{scan_id}andsecurity://rules
Requirements
pip install mcp-safeguard, or run the container syedanas01/mcp-safeguard:latest. As a CLI it needs nothing else: mcp-safeguard scan your-config.json, with --severity, --fail-on, --format json and --output. As an MCP server it runs through fastmcp — fastmcp run src/mcp_shield/server.py for stdio, or --transport sse --port 8000 for remote clients — with MCP_SHIELD_API_KEY in the client env. Python 3.11+. There is a pre-commit hook and GitHub Actions and GitLab CI snippets. Package mcp-safeguard 0.4.0, MIT licensed.
Setup effort
One command — pip install mcp-safeguard
USE CASES
01
Checking your own client config
Scan the config file your assistant loads and see what it is actually trusting, with CVSS scores and a fix line per finding.
02
Vetting a server before you install it
Analyse its tool definitions for injection and poisoning — hidden instruction tags, deception directives, exfiltration patterns.
03
Failing the build on a vulnerable config
Add the scan to CI with a severity threshold, so it exits non-zero when something crosses the line.
04
Checking whether things got worse
Diff this scan against the last one and look at the regressions rather than the whole report.
7 tools
Listed in project docs. Your client may show a different list.
scan_tool_definitionscheck_auth_configcheck_endpoint_exposuregenerate_security_reportget_scan_historycompare_scansBEFORE YOU INSTALL
What to know first
Tools you get
7 tools named in the project's documentation.
Where it runs
Both documented clients run the server on your machine.
INSTALLATION
Connect your client
Server setup
TERMINAL
pip install mcp-safeguardMCP Clients
Claude Desktop
CLAUDE DESKTOP · JSON
{
"mcpServers": {
"mcp-safeguard": {
"command": "python",
"args": [
"-m",
"fastmcp",
"run",
"src/mcp_shield/server.py"
],
"env": {
"MCP_SHIELD_API_KEY": "<YOUR_MCP_SHIELD_API_KEY>"
}
}
}
}Cursor
CURSOR · JSON
{
"mcpServers": {
"mcp-safeguard": {
"command": "python",
"args": [
"-m",
"fastmcp",
"run",
"src/mcp_shield/server.py"
]
}
}
}
