# Mcp Safeguard

> 🛡️ Automated security scanner for MCP (Model Context Protocol) servers — 52 rules for prompt injection, credential exposure, SSRF & tool poisoning. pip install mcp-safeguard

- **Type:** MCP server
- **Install:** `agentstack add mcp-syedanas01-mcp-safeguard`
- **Verified:** Pending review
- **Seller:** [SyedAnas01](https://agentstack.voostack.com/s/syedanas01)
- **Installs:** 0
- **Category:** [Cloud & Infrastructure](https://agentstack.voostack.com/c/cloud-infrastructure)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [SyedAnas01](https://github.com/SyedAnas01)
- **Source:** https://github.com/SyedAnas01/mcp-safeguard
- **Website:** https://syedanas01.github.io/mcp-safeguard

## Install

```sh
agentstack add mcp-syedanas01-mcp-safeguard
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# 🛡️ mcp-safeguard

**The security scanner for MCP servers.**

Detect prompt injection · credential leaks · exposed endpoints · tool poisoning

[](https://pypi.org/project/mcp-safeguard/)
[](https://doi.org/10.5281/zenodo.20502474)
[](https://www.python.org/downloads/)
[](https://opensource.org/licenses/MIT)
[](https://mcpservers.org/servers/syedanas01/mcp-safeguard)
[](https://gitlab.com/anasmohiuddinsyed/mcp-safeguard)

```bash
pip install mcp-safeguard
mcp-safeguard scan your-config.json
```

---

## 30-Second Demo

```bash
pip install mcp-safeguard
git clone https://github.com/SyedAnas01/mcp-safeguard && cd mcp-safeguard
mcp-safeguard scan examples/demo-vulnerable-config.json
```

```
┌─────────────────────────────────────────────────┐
│  mcp-safeguard  —  MCP Security Scanner         │
│  github.com/SyedAnas01/mcp-safeguard            │
└─────────────────────────────────────────────────┘

Scanning: examples/demo-vulnerable-config.json
────────────────────────────────────────────────────────────
  [CRITICAL]  CRED-007  AWS Access Key ID
              Location: env.AWS_ACCESS_KEY_ID
              Evidence: AKIA************MPLE
              CVSS:     9.9
              Fix:      Rotate AWS credentials. Use IAM roles.

  [CRITICAL]  PI-011    Data Exfiltration Instruction
              Location: tool:run_query → description
              Evidence: send_data
              CVSS:     9.5
              Fix:      Immediately audit — designed to exfiltrate data.

  [HIGH]      TP-002    Covert Operation Descriptor
              Location: tool:summarize_document.description
              Evidence: |MCP over SSE/stdio| D
    D --> E & F & G
    E --> M --> N --> O
    E --> H & I & J & K & L
    H & I & J & K & L --> Q & R
```

---

## Why This Matters

External research confirms the threat is real: [MCPTox (2025)](https://arxiv.org/abs/2504.03711) found a **72% attack success rate** across 45 production MCP servers, demonstrating that tool poisoning and prompt injection attacks are actively exploitable in today's MCP ecosystem.

OWASP officially added **MCP Tool Poisoning** to their 2026 threat guidance — the same vulnerability category mcp-safeguard's `TP-*` rules detect.

**The gap**: The MCP ecosystem grew from zero to 10,000+ servers in 18 months while security tooling lagged behind. mcp-safeguard is an open-source scanner built specifically for MCP's attack surface — tool definitions, server configs, and SSRF exposure via prompt injection.

The vulnerability patterns mcp-safeguard detects are documented with illustrative examples in [SECURITY-HALL-OF-SHAME.md](SECURITY-HALL-OF-SHAME.md). Run mcp-safeguard on your own servers and contribute real scan results via GitHub Issues or Discussions.

Share your results — open a [Discussion](https://github.com/SyedAnas01/mcp-safeguard/discussions) or submit a PR to SECURITY-HALL-OF-SHAME.md.

---

## Project Resources & Standards Work

### 📰 Press & Community
- **[Hacker News](https://news.ycombinator.com/item?id=48242541)** — "MCP-safeguard: Security scanner for MCP servers" (2026-05-22)
- **[IETF Internet-Draft](https://datatracker.ietf.org/doc/draft-mohiuddin-mcp-security-considerations/)** — draft-mohiuddin-mcp-security-considerations-00, security considerations for the Model Context Protocol
- **OWASP MCP Top 10** — Open PR adding an SSRF prevention/detection recommended control ([PR #42](https://github.com/OWASP/www-project-mcp-top-10/pull/42), under review)

### 🔒 Real-World Fix Credited
- **googleapis/mcp-toolbox** — SSRF via redirect chain (CWE-918, fix in [PR #3448](https://github.com/googleapis/mcp-toolbox/pull/3448), reported by Syed Anas Mohiuddin)

### 📋 Awesome Lists PRs Open
- [awesome-python](https://github.com/vinta/awesome-python) (299K ⭐)
- [awesome-llm-security](https://github.com/corca-ai/awesome-llm-security)
- [awesome-security](https://github.com/sbilly/awesome-security)
- [Prompt-Engineering-Guide](https://github.com/dair-ai/Prompt-Engineering-Guide) (74K ⭐)
- [the-book-of-secret-knowledge](https://github.com/trimstray/the-book-of-secret-knowledge)
- And 9 more awesome lists

Using mcp-safeguard in your pipeline, or found a real issue with it? We welcome scan results and contributions — open a [Discussion](https://github.com/SyedAnas01/mcp-safeguard/discussions) or PR.

---

## Roadmap

- [x] **v0.2** — Tool poisoning detection; CVSS scoring; JSON + Markdown output; batch scanning
- [x] **v0.3** — SSRF detection module (SS-001–003); MCP server dog-fooding
- [ ] **v0.4** — Scan over MCP stdio transport directly; VS Code extension; GitHub Actions plugin
- [ ] **v0.5** — AI-assisted remediation (Claude generates fixes); SBOM for tool supply chain
- [ ] **v1.0** — SOC2/compliance report templates; MCP registry bulk scanning

---

## Contributing

```bash
git clone https://github.com/SyedAnas01/mcp-safeguard
cd mcp-safeguard
python -m venv .venv && source .venv/bin/activate
pip install -e ".[dev]"
pytest tests/ -v
```

Issues and PRs welcome — especially:
- New injection patterns you've seen in the wild
- Credential types not yet covered
- Integrations with other MCP clients
- Scan results from your own MCP servers (add to SECURITY-HALL-OF-SHAME.md)
- OWASP MCP Top 10 rule mappings

---

## License

MIT — see [LICENSE](LICENSE).

---

**If this helped you, please ⭐ the repo — it helps others find it.**

[GitHub](https://github.com/SyedAnas01/mcp-safeguard) · [PyPI](https://pypi.org/project/mcp-safeguard/) · [Issues](https://github.com/SyedAnas01/mcp-safeguard/issues)

## Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [SyedAnas01](https://github.com/SyedAnas01)
- **Source:** [SyedAnas01/mcp-safeguard](https://github.com/SyedAnas01/mcp-safeguard)
- **License:** MIT
- **Homepage:** https://syedanas01.github.io/mcp-safeguard

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** yes
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: flagged — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/mcp-syedanas01-mcp-safeguard
- Seller: https://agentstack.voostack.com/s/syedanas01
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.