Mmcp.market

Agent Security Scanner MCP server

by sinewaveai·io.github.sinewaveai/agent-security-scanner-mcp·v2.0.1·122 stars
No reviews yet

Security layer for AI agents: blocks prompt injection, detects fake packages, scans vulnerabilities.

C58/100grade C
Write a reviewInstall
What users say
No reviews yet
Be the first
Safety scan
C58/100

full report

Adoption
Established

122 stars746 downloads/wk

Reviews

Write one

Nobody has reviewed Agent Security Scanner yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

Agent Security Scanner tools (7)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

  • check_package

    Check if a package name is legitimate or potentially hallucinated (AI-invented)

  • fix_security

    Scan a file and return the fixed content with all security issues resolved

  • list_package_stats

    List statistics about loaded package lists for hallucination detection

  • list_security_rules

    List all available security fix templates and their descriptions

  • scan_agent_prompt

    Scan a prompt/instruction for potential malicious intent before execution. Returns risk assessment and recommended action (BLOCK/WARN/LOG/ALLOW).

  • scan_packages

    Scan code for package imports and check for hallucinated (AI-invented) packages

  • scan_security

    Scan a file for security vulnerabilities and return issues with suggested fixes

Public scan report

scanner v0.1.10 · 2026-09-28 · same rubric, same numbers if you re-run it

1 high2 medium
  • Code scan24 source files scanned3/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitylocal package, no credentials required12/15
  • Maintenancelast push 9 days ago15/15
  • Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10

Findings (3)

  • highShell command built from a string (injection risk)exec.shell-concat
    index.js: …ame, 'analyzer.py'); const result = execSync(`python3 "${analyzerPath}" "${filePath}"`, { encoding: 'utf-8', …
  • mediumsubprocess with shell=Trueexec.shell-true
    index.js: …d(cmd): return subprocess.call(cmd, shell=True) def hash_password(password): retu…
  • mediumeval / new Function usedexec.eval
    index.js: …=== "eval": { description: "Avoid eval() - use safer alternatives", fix: (l…
Overall 58/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

Install Agent Security Scanner in Claude Code, Cursor or VS Code

Runs npx -y agent-security-scanner-mcp on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add agent-security-scanner-mcp -- npx -y agent-security-scanner-mcp
Add to Cursor

What the publisher says

From the Agent Security Scanner repository's README, as published. We do not edit it. Read it on GitHub

agent-security-scanner-mcp

Security scanner for AI coding agents, MCP servers, prompts, and AI-suggested packages.

Run it before Claude Code, Cursor, Windsurf, Cline, OpenCode, or another agent trusts new code, tools, prompts, or dependencies.

Copy-Paste Start

Scan any repo and get an A-F agent security grade:

npx agent-security-scanner-mcp scan-project . --verbosity compact

Install the scanner into your AI coding client:

npx agent-security-scanner-mcp init claude-code

Replace claude-code with cursor, claude-desktop, windsurf, cline, kilo-code, opencode, or cody.

Audit an MCP server before adding it to an agent:

npx agent-security-scanner-mcp scan-mcp ./path/to/mcp-server --verbosity compact

Check AI-generated imports for package hallucinations:

npx agent-security-scanner-mcp scan-packages ./src/app.ts npm --verbosity compact

What It Catches

Screenshots

Project Scan

MCP Server Audit

Package Hallucination Detection

Demos

Run a safe local demo that creates intentionally vulnerable fixtures, scans them, and cleans them up.

# MCP audit demo: tool poisoning, spoofed tool name, command execution, secret exposure
npx agent-security-scanner-mcp demo --type mcp --no-prompt

# Package hallucination demo: real imports mixed with fake AI-generated package names
npx agent-security-scanner-mcp demo --type packages --no-prompt

Expected demo shape:

{
  "grade": "F",
  "findings_count": 8,
  "findings": [
    {
      "rule": "mcp.description-injection",
      "severity": "ERROR",
      "message": "Tool description contains imperative language directed at the LLM."
    },
    {
      "rule": "mcp.tool-name-spoofing",
      "severity": "ERROR",
      "message": "Tool name is close to a well-known MCP tool name."
    }
  ]
}

Install In Your Agent

npx agent-security-scanner-mcp init claude-code

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

Agent Security Scanner: common questions

Is Agent Security Scanner MCP server safe?
With care: it is graded C, so read the findings first (58/100). Read the Agent Security Scanner safety report
How do I install Agent Security Scanner?
It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does Agent Security Scanner need an API key?
Not as far as the registry entry and our scan can tell: no credentials are declared or required.
Is Agent Security Scanner maintained?
The last commit was 24 days ago (2026-09-19). The latest release is v2.0.1.
What can I use instead of Agent Security Scanner?
Servers from other publishers that do the same job: Shellward MCP server, Agent-Native Analytics MCP server and Godot MCP server. Compare all Agent Security Scanner alternatives.

Alternatives to Agent Security Scanner

Same job from other publishers: the closest match first, then the best rated.

All Agent Security Scanner alternatives →
  • Shellward
    AI agent security: 7 MCP tools for injection detection, PII scanning, command safety, DLP.
    A
  • Agent-Native Analytics
    Agent-Native Amplitude/Mixpanel - connect data sources, prompt for charts
    A
  • Godot MCP
    Agent-driven Godot playtesting: editor control, input injection, game-time stepping, live state.
    A
  • Agent Recall
    Correction-first agent memory. Precision KPI tracks if agents heed warnings. 5 layers, local-only.
    A
  • Image
    AI image generation and editing with prompt optimization and quality presets
    B
Agent Security Scanner vs Shellward

More from sinewaveai →