Sentinel Scan MCP server

ventrova.dev · Get your endpoint audited · ⭐ Star this repo · 👁 Watch for new attacks

Sentinel Scan CLI - MCP Security Scanner

10 OWASP-mapped heuristics · 15-attack jailbreak suite · 100% offline · CLI + MCP server

A free, open-source MCP security scanner - available as a CLI and as an MCP server - that statically scans MCP tool manifests (mcp.json) and mcpServers configs for 10 OWASP-mapped heuristics: tool-description prompt injection, tool-name shadowing (tool poisoning), excessive-agency schema patterns, indirect-injection surface area, unpinned/remote server sources, hardcoded credentials, overbroad wildcard scopes, missing provenance/signature metadata, missing human-in-the-loop confirmation, and hidden-unicode/ASCII-smuggling instructions. See MCP tool manifest scan below for the full list.

It also ships a 15-attack prompt-injection and jailbreak suite you can run against your own LLM-backed endpoint. Every finding is tagged with its OWASP LLM Top 10 (and OWASP MCP Top 10) category, so results map straight onto the checklist your security team already uses.

One-line CLI install:

pipx install sentinel-scan-cli
sentinel-scan mcp --demo

One-line MCP server (no install, npx):

{
  "mcpServers": {
    "sentinel-scan": {
      "command": "npx",
      "args": ["-y", "sentinel-scan-cli", "mcp-server"]
    }
  }
}

Drop that into Claude Desktop's or Cursor's MCP config and any client can call the scanmcpmanifest tool directly - no CLI invocation needed. See MCP Server below for the Python/uvx build and tool schema.

No signup, no telemetry, no API key required to run it (--demo mode uses a built-in target with zero network calls). When you point it at your own endpoint, the only network traffic is your machine talking directly to your endpoint - nothing is sent to Ventrova.

Also includes sentinel-scan evidence, which runs the scan(s) above and renders the results straight into a filled EU AI Act Annex IV Lite compliance evidence pack in one step - see Annex IV evidence pack below.

Why this exists

We ran this exact 15-attack corpus against a disposable local test bot (an Ollama-hosted Llama 3.1 model with a planted secret in its system prompt) as a pilot. Results, unedited:

"num_attacks": 15,
"vulnerable_count": 3,
"literal_leak_count": 2

Shortened. The full README is on GitHub.