agent-security-scanner-mcp
Security scanner for coding agents: checks code, MCP servers, prompts and model-invented packages, and gives an A to F grade.
- 123 ★ on the repository
- Last commit
Extended access
Why this level
- Reads project files and dependencies, and `cr-agent` sends code to the chosen provider.
- The `init` command edits the client configuration.
Install
- Works in
Manual install
npx agent-security-scanner-mcp init claude-codeFirst command from the install section of the README. For other clients the last word changes.
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- Reads project files and dependencies, and `cr-agent` sends code to the chosen provider.
- The `init` command edits the client configuration.
This is third-party code. Review the repository files before installing.
What it does
The scanner runs as a CLI through `npx` and as an MCP server for the agent. The `scan-project` command checks a repository for vulnerabilities in generated code and gives an A to F grade. `scan-diff` looks only at changed files, and `scan-mcp` inspects an MCP server before installation for poisoned tool descriptions, name spoofing and environment variable leaks. Separate checks cover prompt injection in text, risky agent actions before execution and packages that do not exist, since models often invent dependency names. The lookup data covers npm, PyPI, RubyGems, crates.io, pub.dev, CPAN and raku.land. The package also generates CycloneDX SBOMs, finds known dependency vulnerabilities through OSV.dev and includes `cr-agent`, a semantic code review run by a model you choose.
Who it is for. Developers who accept code, dependencies and MCP servers from agents and want them checked before merging.
Good fit when
- An agent wrote a pull request and the changes need a quick pass before merge.
- An unfamiliar name appeared in the dependency list and a model may have invented it.
- Before adding someone else's MCP server you want its descriptions and behavior checked.
- A release requires an SBOM and a list of known dependency vulnerabilities.
Not a fit when
- You need a full security audit with manual review: the scanner catches typical patterns.
- Code cannot be passed to a chosen model but `cr-agent` is required.
- A list of known vulnerabilities from `npm audit` is enough: this tool complements it and does not replace it.
Example request
Run this branch's changes against main through the scanner, check the new imports for invented packages and list findings by severity.MCP
- Transport
- stdio
- Authentication
- not required
Limitations
The grade and rules cover typical patterns, so a clean result does not prove safety. The `init` command adds the scanner to the chosen client configuration, and the client must be restarted afterwards. Rule-based and MCP checks run locally, while `cr-agent` sends code to the provider you choose. Package checks rely on public name lists and need network access. Releases are frequent and each version is described in `CHANGELOG.md`.
How to disable. Remove the `agent-security-scanner-mcp` entry from the client configuration where `init` added it. If you set up CI, delete the generated workflow.
FAQ
How do I connect the scanner to Claude Code or Cursor?
Run `npx agent-security-scanner-mcp init claude-code`. Replace `claude-code` with `cursor`, `windsurf`, `cline`, `opencode` or another client from the README table, then restart the client.
How do I quickly grade a repository?
Run `npx agent-security-scanner-mcp scan-project . --verbosity compact`. The result contains an A to F grade and a list of findings.
Does the scanner send code out?
Rule-based and MCP checks run locally. The exception is `cr-agent`, which uses the provider you pick.
How do I cut down output size?
The `--verbosity` flag accepts `minimal`, `compact` and `full`. Use `compact` for agents and `minimal` for CI.
What does `scan-action` check?
Risky shell commands and file or network actions of the agent before execution. Call it as `scan-action <type> <value>`.
Discussion
No questions or reviews yet.
Related
MCP serversA static scanner for vulnerabilities in AI agent code and MCP configs with 66 rules mapped to OWASP Agentic Top 10
Security scanner for MCP servers that looks for hardcoded keys, tool poisoning and injection flaws in repository code.
A Snyk CLI that discovers installed MCP servers, skills and agents on your machine and checks them for prompt injections and malicious payloads
Security scanner for agent skills and MCP servers: finds prompt injection, data exfiltration and supply chain risks before install
A scanner that finds leaked keys, dangerous access and connected models in MCP configs of Claude Desktop, Cursor and VS Code.
A CLI that scans your machine for skills and MCP configs, finds poisoned tool descriptions and runs a system prompt through 225 attacks
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Authentication | Repository stars | Main difference |
|---|---|---|---|---|
| agent-security-scanner-mcp (this card) | no | not required | 123 | |
| MCP Scanner | yes | 1,109 | checks only MCP servers and their tools; this scanner adds code, prompts, packages and SBOM | |
| Skill Scanner | no | 2,695 | looks for threats in agent skills; here the repository, diffs, MCP and dependencies are covered too |
README in short
The README opens with quick start commands, then shows a table of risks and matching commands, demos with intentionally vulnerable fixtures and a reference for the CLI and MCP tools.