manthanghasadiya/mcpsec
View on GitHub ↗An AI-driven dynamic protocol fuzzer for the Model Context Protocol (MCP). Prove runtime exploitability by discovering state violations, transport crashes, and application-layer logic flaws (SSRF, LFI) before your AI agents do.
23 ★3 forksPythonUpdated 1mo ago
What you need to know
mcpsec is a security scanner and protocol fuzzer for MCP servers that connects to live servers to prove exploitation, combining runtime scanning, static analysis (3,450+ sink patterns and 149 Semgrep rules) and 22 fuzz generators.
Install
pip install mcpsec pip install mcpsec[ai]
Key features
- ✓Runtime scanning over stdio or HTTP
- ✓Static analysis with 3,450+ sink patterns
- ✓149 Semgrep rules
- ✓22 fuzz generators with up to 1500+ cases
- ✓16 scanners including prompt injection, SSRF, SQLi and IDOR
- ✓AI-powered payload generation
- ✓SARIF output for CI
Caveats
- ⚠For authorized security testing only
Topics
ai-securityappseccybersecurityfuzzermcpmcp-servermcp-toolsmodel-context-protocolpentestingssrfvulnerability-scanners
- Stars
- 23★
- Forks
- 3
- Language
- Python
- License
- MIT
- Created
- 2026-02-18
- Last push
- 2026-08-13