MCP Security Score
Documentation

Introduction to MCP Security Score

MCP Security Score is a comprehensive security analysis tool designed specifically for Model Context Protocol (MCP) servers. It helps developers identify security vulnerabilities, unsafe coding patterns, and potential risks before deploying MCP servers to production.

What is MCP?

The Model Context Protocol (MCP) is an open standard that enables AI assistants to securely connect with external data sources, tools, and services. MCP servers expose tools and resources that AI models can use to perform actions like reading files, executing code, or accessing APIs.

Because MCP servers often have significant system access and handle sensitive operations, security is paramount. A vulnerable MCP server could allow:

  • Remote code execution through unsafe eval or command injection
  • Data exfiltration via exposed credentials or sensitive paths
  • Supply chain attacks through compromised dependencies
  • Prompt injection that manipulates AI behavior

Why Use MCP Security Score?

MCP Security Score provides automated security analysis that would otherwise require manual code review by security experts:

Static Analysis

Our scanner analyzes your source code without executing it, detecting:

  • Dangerous function calls (eval, exec, child_process)
  • Hardcoded secrets and API keys
  • Insecure network configurations
  • Path traversal vulnerabilities
  • Supply chain risks in dependencies

AI-Powered Analysis

Using Claude's AI capabilities, we provide:

  • Behavioral analysis of your MCP server
  • Detection of prompt injection vulnerabilities
  • Risk assessment and recommendations
  • Executive summaries for stakeholders

Security Scoring

Every scan produces:

  • An overall security score (0-100)
  • Letter grade (A-F) for quick assessment
  • Category breakdown by risk area
  • Actionable remediation guidance

Supported Languages

MCP Security Score currently supports:

| Language | Extensions | MCP Frameworks | |----------|-----------|----------------| | TypeScript | .ts, .tsx | @modelcontextprotocol/sdk | | JavaScript | .js, .jsx, .mjs, .cjs | @modelcontextprotocol/sdk | | Python | .py, .pyw | mcp, FastMCP |

Getting Started

Ready to scan your first MCP server? Here's how to get started:

  1. Create an account - Sign up at mcpscanner.com
  2. Start a scan - Enter a GitHub URL or upload a ZIP file
  3. Review results - Analyze your security score and findings
  4. Fix vulnerabilities - Follow the remediation guidance

For a step-by-step walkthrough, see our Quick Start Guide.

Security Checks

MCP Security Score runs 43 security checks across these categories:

  • RCE (Remote Code Execution) - 5 checks
  • Secrets Detection - 3 checks
  • Network Security - 3 checks
  • Filesystem Security - 2 checks
  • Supply Chain - 6 checks
  • MCP-Specific (TypeScript) - 6 checks
  • Python Security - 11 checks
  • MCP-Specific (Python) - 7 checks

See the Security Checks Reference for detailed documentation of each check.

Next Steps