DaoyuanLi2816/mcp-fence

View on GitHub ↗

Local-first security scanner, MCP protocol inspector, dynamic fuzzer, Docker sandbox, and report generator for Model Context Protocol servers.

36 ★7 forksPythonUpdated 1mo ago

What you need to know

Local-first security scanner, MCP protocol inspector, dynamic fuzzer, Docker sandbox, and report generator for MCP servers. Statically scans config/source, inspects servers live over stdio, fuzzes tools with schema-aware payloads, and outputs plain-text, JSON, SARIF 2.1.0, or offline HTML reports.

Install

pip install mcp-fence

Usage

  • •Point it at an mcp.json: mcp-fence scan/inspect/fuzz/sandbox, then generate reports (mcp-fence report).

Key features

  • ✓Static scanning (tool poisoning, dangerous startup commands, plaintext secrets)
  • ✓Live inspect over stdio
  • ✓Schema-aware fuzzing
  • ✓Docker sandbox profiles (strict, filesystem-readonly, network-deny, dev)
  • ✓SARIF/HTML/JSON reports
  • ✓GitHub Action for code scanning

Best for

Security auditing and fuzzing of MCP servers before use

Caveats

  • ⚠Live inspect/fuzz currently support stdio; HTTP/SSE is static-scan only
  • ⚠Python 3.11+

Reviewed 2026-08-11

Topics

fuzzerllm-securitymcpmodel-context-protocolprompt-injectionsandboxsarifscannersecuritytool-poisoning
Stars
36★
Forks
7
Language
Python
License
Apache-2.0
Created
2026-05-16
Last push
2026-07-11