security probe for MCP servers

Scan an exposed MCP server before the agents do.

Trend Micro's April 2026 sweep found 492 MCP servers reachable on the open internet with no authentication and no controls, plus 1,184 malicious skills in one MCP marketplace. AI agents talking to these servers inherit whatever authority the server exposes — exec_command reachable from any browser tab is RCE-as-a-feature.

Authenticated scan (optional)

If your server requires auth, paste a header here. Only Authorization, X-API-Key, X-Auth-Token, API-Key, and Cookie are accepted. When any auth header is sent, the NO_AUTH_REQUIRED finding is suppressed (you're telling the scanner the server should require auth).

Rate limit: 1 scan per minute per IP. The scanner only calls */list methods — no tools are invoked.

What this is — and isn't

What it does

  • POSTs the MCP initialize handshake to the URL you give it.
  • Calls tools/list, resources/list, prompts/list — read-only.
  • Applies a small ruleset to flag dangerous tool names, missing schemas, sensitive resource paths, plaintext transport, permissive CORS, and the headline finding: no auth required.
  • Returns a structured report. JSON is available for piping into CI; markdown is the human-readable view.

What it isn't

  • Not an attack tool. Tool calls are never made. Calling exec_command to prove it executes is a deliberate non-feature.
  • Not a comprehensive audit. False positives are likely (a tool named query_inventory trips the SQL pattern). The report exists to get a human to read four or five tool descriptions.
  • Not stored. URLs and findings are not persisted. Each scan is ephemeral.

Rules applied

IDSeverityTrigger
NO_AUTH_REQUIREDHIGHinitialize succeeds with zero auth headers
DANGEROUS_TOOLHIGHTool name/description matches command / SQL / filesystem / SSRF / credential patterns
SENSITIVE_RESOURCE_EXPOSEDHIGHResource URI looks like /etc/passwd, .env, .ssh/, .aws/credentials, etc.
PLAINTEXT_TRANSPORTMEDIUMNon-loopback http:// URL
PERMISSIVE_CORSMEDIUMAccess-Control-Allow-Origin: *
TOOL_MISSING_SCHEMAMEDIUMTool advertised with no inputSchema
TOOL_SCHEMA_OPENLOWTool object schema doesn't set additionalProperties: false
TOOL_LOOSE_STRING_FIELDSLOWPrivileged tool has unconstrained string fields
SERVER_INFO_DISCLOSEDINFOServer announces name / version