Open-source CLI scans MCP servers for injection risks, secrets and bad tools
Technical_Currency_2 · reddit · 2026-07-29
An open-source CLI now scans MCP servers for command injection, committed secrets, and risky tool descriptions before you trust them.
What it checks
- Command-injection risks
- Committed secrets
- Prompt-injection markers in tool descriptions
- Over-broad or destructive tools
The tool can run on a GitHub repo, npm/PyPI package, local project, or live endpoint. It is deterministic by default, but offers an optional --judge mode where an LLM can look for issues that rule-based scanning may miss. Builders can also wire it into CI/CD and gate merges with a minimum grade such as --min-grade B.
The same engine also powers a public index that continuously scans the official MCP registry.
Related event: Open-Source MCP Scanner Detects Injections and Leaked Secrets(2 posts)→
More from coding & agent
- Why company AI agents go stale: adoption needs in-house knowledge, not just better agents — EdenEmarco177 · 2026-10-16
- Cheng Lou open-sources Handwired: hand-written weights turn code into training-free neural nets — dotey · 2026-10-16
- Building a portable context vault in Notion so every AI agent knows you from day one — ivanhzhao · 2026-10-16
- Lovable apps can now talk to customers on WhatsApp with inbox, reminders and templates — AlexandrePesant · 2026-10-16
- FDE-Gym benchmark: best agent fully solves only 14 of 95 real customer-delivery tasks — dair_ai · 2026-10-16
- Deep Research API showdown: OpenAI, Perplexity, Parallel, Tavily, Gemini, Valyu compared — bar_raiser333 · 2026-10-16