MCP servers are becoming the backbone of AI agent architectures — Claude Code, Cursor, Windsurf, and every tool that speaks the Model Context Protocol. Most are deployed with zero security review. MCP Scanner changes that.

One scan. Auth bypasses, injection vulnerabilities, CORS misconfigs, dangerous tool capabilities, transport weaknesses, and more — scored, graded, and actionable.

• MCP Scanner CLI — open-source (Apache 2.0) command-line scanner. Single binary, zero dependencies, runs anywhere. Scan HTTP/SSE endpoints or analyze config files (Claude Desktop, Cursor). Outputs text, JSON, or HTML reports with severity scoring.

• MCP Scanner (hosted) at mcpscanner.dev — the same engine in your browser. Paste a URL, watch a live scan, get a graded report. No account needed.

• Playground at playground.mcpscanner.dev — a public, intentionally-vulnerable demo MCP server (/error, /success, /random) to point any scanner at. Open source, Apache 2.0.

• Authentication — unauthenticated access, default/weak credentials
• Transport — missing TLS, CORS wildcard, CORS origin reflection
• Tool analysis — filesystem/code-exec/database/network tool detection, parameter inspection, input validation gaps, excessive tool exposure
• Active probing — path traversal, command injection, SQL injection, SSRF, prompt injection reflection
• Rate limiting — missing request throttling
• Config analysis — root execution, dangerous packages, unpinned versions, hardcoded secrets, missing auth

# Install — macOS / Linux
brew install mcpscanner/tap/mcpscanner          # Homebrew
curl -fsSL https://install.mcpscanner.dev/install.sh | sh   # or one-liner
go install github.com/mcpscanner/cli@latest     # or from source (Go 1.24+)

# Install — Windows
scoop bucket add mcpscanner https://github.com/mcpscanner/scoop-bucket
scoop install mcpscanner

# Scan an HTTP MCP server
mcpscanner scan https://your-mcp-server.com/mcp

# Scan a config file (Claude Desktop / Cursor format)
mcpscanner scan --config ~/.claude/claude_desktop_config.json

# JSON output for CI/CD
mcpscanner scan https://your-mcp-server.com/mcp --format json

# Try it against the public playground
mcpscanner scan https://playground.mcpscanner.dev/error

Found a vulnerability in MCP Scanner itself? Report to hello@codelake.dev.

• Product: mcpscanner.dev
• Support: hello@mcpscanner.dev
• Issues: per-repo within this org

MCP Scanner is built by codelake Technologies LLC, an Akyros Labs brand. mcpscanner.dev · hello@mcpscanner.dev