rob925/mcp-shield

Security scanner and MCP server for Model Context Protocol servers, tools, prompts, and AI agent projects.
MCP gives agents access to tools. MCP Shield helps you catch the obvious dangerous parts before they reach production: leaked secrets, shell execution, risky tool descriptions, prompt-injection text, and CI-breaking security regressions.
Why MCP Shield
MCP servers often expose powerful capabilities: filesystem access, shell commands, network calls, credentials, browser automation, databases, and internal tools.
That is exactly where small mistakes become expensive:
- a tool description encourages unsafe behavior
- a test key becomes a real leaked token
- an agent can call a shell command with user-controlled input
- a prompt or resource contains injection text
- CI has no security gate for MCP-specific risks
MCP Shield is the simple first line of defense: fast static checks, useful output, and a non-zero exit code when risk crosses your threshold.
Features
- runs as both a CLI and an MCP server
- built on the official MCP Python SDK
- CI-friendly severity gates
- text, JSON, Markdown, and SARIF output
- inline suppressions with rule IDs
- .mcp-scan-ignore for fixtures and intentional demos
What It Finds
| Risk | Examples |
| --- | --- |
| Hard-coded secrets | API keys, tokens, passwords, private keys |
| Process execution | subprocess, child_process, shell=True |
| MCP tool risk | tools named or described as delete, shell, token, secret, filesystem |
| Environment access | os.environ, process.env |
| Prompt injection text | "ignore previous instructions", system prompt leakage phrases |
Install
From a local checkout:
Run without installing:
MCP Server
Run MCP Shield as a stdio MCP server:
Available tools:
- scan_path_tool - scan a local MCP server or agent project
- list_rules - list rule IDs and descriptions
Example Claude Desktop-style command:
Usage
Formats:
- text for humans
- json for automation
- markdown for PR comments and reports
- sarif for GitHub code scanning
Severity gates:
- low
- medium
- high
- critical
--fail-on high exits with code 1 when any high or critical finding exists.
Ignore Files
Create .mcp-scan-ignore in the scanned directory:
Use this for intentional fixtures and demos. Do not use it to hide production risks.
Suppressions
Suppress a reviewed finding on the same line:
Use all only for test fixtures:
Example
Scan the intentionally unsafe example:
GitHub Actions
Roadmap
- MCP SDK-aware parsing for Python and TypeScript servers
- safer default rule pack for enterprise MCP servers