sahiloj/MCPScan
View on GitHub ↗Offensive MCP server auditor: detects tool poisoning, credential leaks, RCE vectors, SSRF, session hijacking, and supply chain vulnerabilities across stdio, HTTP, and SSE transports.
24 ★7 forksTypeScriptUpdated 5mo ago
What you need to know
An offensive security auditor for MCP servers. Analyzes MCP configurations and servers to find security issues like prompt injection surfaces, SSRF and credential handling risks.
Key features
- ✓Security audit of MCP servers
- ✓Detection of SSRF, injection and credential risks
- ✓Configuration hardening checks
Best for
Security testing MCP servers before use
Reviewed 2026-08-11
Topics
ai-securityllm-securitymcpmcp-securitymcpscanmodel-context-protocoloffensive-securityopen-sourcesecuritysupply-chaintool-poisoningvulnerability-scanner
- Stars
- 24★
- Forks
- 7
- Language
- TypeScript
- License
- MIT
- Created
- 2026-03-10
- Last push
- 2026-03-12