Assay

Assay is an MCP & Claude Code security scanner. It threat-models plugins, MCP servers, hooks, skills & connectors with an LLM — not regex — to catch prompt injection, credential exfiltration, and MCP tool poisoning before you trust them. Runs on your Claude Code subscription — no separate API key required.

📚 Documentation  ·  Install  ·  Quickstart  ·  How it works  ·  FAQ

▶ Demo — inventory your Claude Code stack, then threat-model and scan an MCP server end to end.

https://github.com/user-attachments/assets/8e6e1c3f-358a-4cf1-a50c-6e15fbf43c75

---

What it does

Before you install a plugin or wire up an MCP server, Assay threat-models what it could do, then reads the code for evidence — every finding backed by a verbatim file:line quote. It's built for MCP security and the wider Claude Code attack surface, where the dangerous behavior is usually legal code with bad intent that SAST and dependency scanners miss.

• Reasons, doesn't pattern-match — an LLM builds a threat model before it reads source, so the review is hypothesis-driven, not regex.
• Catches AI-native threats — prompt injection, MCP tool poisoning, credential exfiltration, hook abuse, capability-vs-claim mismatch.
• No confabulation — a post-validator re-reads every citation and drops anything the model can't back with real code.
• Runs on your subscription — default mode drives Claude Code via claude -p; no separate API key, no rate-limit walls.
• One binary, three roles — the CLI, the assay serve web UI, and the assay mcp server Claude Code drives.

Verdict: safe / caution / unsafe, written as audit.json + audit.md.

Quickstart

git clone https://github.com/chawdamrunal/assay.git && cd assay
make build && make install          # single binary, React UI embedded

assay inventory                     # what's installed in ~/.claude
assay serve                         # http://localhost:7373 → "New Scan"

Full guide → Installation · Quickstart.

Documentation

The full docs live at chawdamrunal.github.io/assay:

• Installation — build from source, curl / Homebrew / WinGet / Docker, auth
• Quickstart — scan from the web UI or CLI, the pre-install gate, private GitHub repos
• How it works — the 5-stage methodology, both scan modes, threat coverage
• How to threat-model an MCP server — the practical MCP security checklist
• MCP tool poisoning — what it is and how to detect it
• Threat model — the 12 AI dev-stack threat classes
• FAQ — vs. Snyk / Cisco, API-key needs, tool poisoning, source privacy

Deeper references in-repo: [ARCHITECTURE.md](ARCHITECTURE.md) · [threat model](docs/threat-model-2026.md) · [CHANGELOG.md](CHANGELOG.md).

Status

Pre-1.0, under active development. The MCP-server architecture is the default scan path; the legacy in-process orchestrator remains as an API-key / CI fallback. Report a security issue in Assay itself via [SECURITY.md](SECURITY.md).

Contributing

See [CONTRIBUTING.md](CONTRIBUTING.md). TDD-disciplined; every finding must cite a verbatim quote — enforced at runtime and in review.

License

Apache-2.0. See [LICENSE](LICENSE).

Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: chawdamrunal
• Source: chawdamrunal/assay
• License: Apache-2.0
• Homepage: https://chawdamrunal.github.io/assay/

Install and usage instructions live in the source repository linked above.