Ramparts CLI
A security scanner for MCP servers and agent skills that looks for prompt injection, secret leaks and swaps after approval.
- 99 ★ on the repository
- Last commit
- Apache-2.0
Extended access
Why this level
- For stdio servers the scanner runs the command of the server under test on your machine.
- HTTP server tokens are passed in `--auth-headers` and end up in shell history.
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add cli/rampartsDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- For stdio servers the scanner runs the command of the server under test on your machine.
- HTTP server tokens are passed in `--auth-headers` and end up in shell history.
This is third-party code. Review the repository files before installing.
What it does
Ramparts, written in Rust, checks the two places an agent trusts most: MCP servers over the network and skill files on disk. `ramparts scan` walks a server's tools, resources and prompts, `ramparts scan-config` finds servers in Cursor, Windsurf, VS Code, Claude Desktop, Claude Code and Cline configurations, and `ramparts skills scan` reads Claude Code commands and agentskills.io bundles along with their scripts. Checks run 40 YARA rules. For servers launched through npx and uvx the scanner queries the OSV.dev vulnerability database, and it compares fingerprints of configurations, tools and skills with a stored baseline to catch swaps after approval. Reports come out in the terminal, JSON, SARIF 2.1.0 or Markdown.
Who it is for. People who connect third-party MCP servers and skills to Claude Code or Cursor and want to vet them before use, including in CI.
Good fit when
- Before connecting a third-party MCP server you need to see what hides in its tool descriptions.
- A team keeps skills in `.claude/commands` and wants findings in GitHub code scanning through SARIF.
- A skill author checks the name in SKILL.md against the folder name and looks for overly broad allowed-tools before publishing.
- MCP configurations in a repository are checked on every pull request.
Not a fit when
- You need protection while the agent runs: Ramparts reads metadata and files, and its authors advise adding runtime guardrails separately.
- The check runs in an isolated network without access to OSV.dev: the vulnerability lookup uses the network.
- You need a full source review of a server: the scanner looks at tool descriptions, configurations and skill files.
Example request
Run ramparts scan-config with a report and show the servers with HIGH and CRITICAL findings.Limitations
The scanner assesses static metadata, configurations and skill files, so it gives full protection only together with runtime guardrails. A stdio server is passed as a launch command such as `stdio:npx:mcp-server-commands`, and that server starts on your machine. HTTP servers with authentication need a header through `--auth-headers` with your token. Dependency vulnerabilities come from OSV.dev queries. It installs through Cargo and needs Rust 1.70 or newer. The project is under active development and MCP and skill threats change quickly, so the rule set lags over time.
How to disable. Uninstall the ramparts package installed through Cargo. If you ran `ramparts server`, stop that process.
FAQ
How do I scan Claude Code skills?
Run `ramparts skills scan ./.claude/commands` for one folder or `ramparts skills scan-config` to find skills in `.claude`, `.cursor`, `.codex`, `.windsurf` and `.gemini`.
Can results go to GitHub code scanning?
Yes. Add `--format sarif` and redirect output to a file: `ramparts skills scan ./.claude/commands --format sarif > skills.sarif`. GitHub Advanced Security, GitLab and Azure DevOps accept SARIF 2.1.0.
Does Ramparts have a server mode?
Yes. `ramparts server` starts a REST API for continuous monitoring and CI, and `ramparts mcp-stdio` exposes the scanner itself as a stdio MCP server.
What does a swap after approval mean?
Ramparts stores fingerprints of configurations, tools and skill files and reports changes: `MCPConfigChanged`, `MCPToolChanged` and `SkillContentChanged`. That shows an approved tool was replaced.
What does the scanner look for in skills?
Overly broad allowed-tools, vague triggers, references to sensitive paths, base64 and hex payloads, name collisions, writes to agent memory files and undeclared network egress.
Discussion
No questions or reviews yet.
Related
CLI toolsSecurity scanner for coding agents: checks code, MCP servers, prompts and model-invented packages, and gives an A to F grade.
Security scanner for agent skills and MCP servers: finds prompt injection, data exfiltration and supply chain risks before install
A scanner that finds leaked keys, dangerous access and connected models in MCP configs of Claude Desktop, Cursor and VS Code.
Security scanner for MCP servers that looks for hardcoded keys, tool poisoning and injection flaws in repository code.
A Snyk CLI that discovers installed MCP servers, skills and agents on your machine and checks them for prompt injections and malicious payloads
A static scanner for vulnerabilities in AI agent code and MCP configs with 66 rules mapped to OWASP Agentic Top 10
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Repository stars | Main difference |
|---|---|---|---|
| Ramparts (this card) | no | 99 | |
| MCP Scanner | yes | 1,117 | the Cisco AI Defense scanner for MCP servers; Ramparts also checks skill files and swaps after approval |
| Skill Scanner | no | 2,724 | checks skills before installation; Ramparts adds MCP server and IDE configuration scanning |
README in short
Findings carry OWASP MCP Top 10 tags, and skill findings also get OWASP Agentic Skills Top 10 tags (AST01–AST10). Skills get structural checks: overly broad allowed-tools, references to sensitive paths, hidden base64 and hex payloads, name collisions.