kapilduraphe/mcp-watch

A comprehensive security scanner for Model Context Protocol (MCP) servers that detects vulnerabilities and security issues in your MCP implementations.
Features
- **🔑 Credential Detection** - Finds hardcoded API keys, tokens, and insecure credential storage
- **🧪 Tool Poisoning** - Detects hidden malicious instructions in tool descriptions
- **🎯 Parameter Injection** - Identifies magic parameters that extract sensitive AI context
- **💉 Prompt Injection** - Scans for prompt manipulation and injection attacks
- **🔄 Tool Mutation** - Detects dynamic tool changes and rug-pull risks
- **💬 Conversation Exfiltration** - Finds triggers that steal conversation history
- **🎨 ANSI Injection** - Detects steganographic attacks using escape sequences
- **📋 Protocol Violations** - Identifies MCP protocol security violations
- **🛡️ Input Validation** - Finds command injection, SSRF, and path traversal issues
- **🎭 Server Spoofing** - Detects servers impersonating popular services
- **🌊 Toxic Flows** - Identifies dangerous data flow patterns
- **🔐 Permission Issues** - Finds excessive permissions and access control problems
Quick Start 🚀
Option 1: NPM Package (Recommended)
Option 2: From GitHub Source
Option 3: Docker (No Installation)
Installation
Global Installation
Local Installation
From Source
Docker Installation 🐳
Quick Start with Docker
Docker Compose (Recommended for Production)
Docker Features
- **🔒 Security**: Non-root user, minimal attack surface
- **📦 Optimized**: Multi-stage builds, Alpine Linux base
- **🚀 Production**: Ready for deployment and CI/CD
- **🧹 Simplified**: Single optimized Dockerfile for all use cases
Usage
Command Line
Scan GitHub Repositories
Scan Local Projects
Installation Method Usage
From NPM Package
From GitHub Source
Docker Usage 🐳
Options
- --format - Output format: console (default) or json
- --severity - Minimum severity: low, medium, high, critical
- --category - Filter by vulnerability category
Categories
- credential-leak - Hardcoded credentials and insecure storage
- tool-poisoning - Malicious tool descriptions
- data-exfiltration - Data theft and parameter injection
- prompt-injection - Prompt manipulation attacks
- tool-mutation - Dynamic tool changes
- steganographic-attack - Hidden content in escape sequences
- protocol-violation - MCP protocol security issues
- input-validation - Command injection, SSRF, path traversal
- server-spoofing - Server impersonation
- toxic-flow - Dangerous data flows
- access-control - Permission and access issues
Example Output
Development
Project Structure
Development Scripts
Development Workflow 🚀
Local Development (Recommended)
Docker Development 🐳
Adding New Scanners
1. Create a new scanner in scanner/scanners/
2. Extend AbstractScanner
3. Implement the scan() method
4. Add to MCPScanner.ts
Example:
Security Research
This tool is based on security research from leading organizations in AI and cybersecurity, identifying novel attack vectors specific to MCP environments including:
- **Parameter injection attacks** that extract sensitive AI context
- **Tool poisoning** with hidden malicious instructions
- **Conversation exfiltration** using trigger phrases
- **Steganographic attacks** via ANSI escape sequences
- **Toxic agent flows** across repository boundaries