MCPAmpel - MCP Security Scanner MCP server

MCPAmpel - MCP Security Scanner

Scan your installed MCP servers for security vulnerabilities, directly from your AI agent.

MCPAmpel discovers MCP servers from your Claude Code, Cursor, Windsurf, or Gemini CLI configuration, submits them to 16 scanning engines, and returns an aggregated trust score with detailed findings.

50 API calls/day included.

Quick Start

uvx mcpampel

Configuration

Claude Code / Claude Desktop

Add to ~/.claude/settings.json or claudedesktopconfig.json:

{
  "mcpServers": {
    "mcpampel": {
      "command": "uvx",
      "args": ["mcpampel"],
      "env": {
        "MCPAMPEL_API_KEY": "your_key_here"
      }
    }
  }
}

Cursor

Add to ~/.cursor/mcp.json:

{
  "mcpServers": {
    "mcpampel": {
      "command": "uvx",
      "args": ["mcpampel"],
      "env": {
        "MCPAMPEL_API_KEY": "your_key_here"
      }
    }
  }
}

Windsurf

Add to ~/.codeium/windsurf/mcp_config.json:

{
  "mcpServers": {
    "mcpampel": {
      "command": "uvx",
      "args": ["mcpampel"],
      "env": {
        "MCPAMPEL_API_KEY": "your_key_here"
      }
    }
  }
}

Gemini CLI

Add to ~/.gemini/settings.json:

{
  "mcpServers": {
    "mcpampel": {
      "command": "uvx",
      "args": ["mcpampel"],
      "env": {
        "MCPAMPEL_API_KEY": "your_key_here"
      }
    }
  }
}

Getting an API Key

Register for free at mcpampel.com.

Environment Variables

Tools

scanmyservers

Discovers all MCP servers from your editor config and scans them with 16 engines. Returns a summary table with trust scores. No input needed.

scan_url

Scan a single GitHub, GitLab, npm, or PyPI URL. Returns trust score, engine breakdown, and findings.

check_status

Show your daily quota usage and remaining scans.

getscanresults

Get detailed results for a specific scan by ID. Use after scanmyservers or scan_url to drill into findings.

Development

cd mcp-plugin
uv sync
uv run pytest

License

Apache License 2.0

mcpampel.com

<!-- mcp-name: io.github.MCPAmpel/mcpampel -->