Open-source CLI scans MCP servers for injection risks, secrets and bad tools
Technical_Currency_2 · reddit · 2026-07-29
An open-source CLI now scans MCP servers for command injection, committed secrets, and risky tool descriptions before you trust them.
What it checks
- Command-injection risks
- Committed secrets
- Prompt-injection markers in tool descriptions
- Over-broad or destructive tools
The tool can run on a GitHub repo, npm/PyPI package, local project, or live endpoint. It is deterministic by default, but offers an optional --judge mode where an LLM can look for issues that rule-based scanning may miss. Builders can also wire it into CI/CD and gate merges with a minimum grade such as --min-grade B.
The same engine also powers a public index that continuously scans the official MCP registry.
More from coding & agent
- Inside OpenAI’s push to redesign software development for the agent era — danshipper · 2026-07-29
- opendot snapshots every shell action so terminal coding agents can be undone — alexriley12345 · 2026-07-29
- Open-source CLI agent goes public as more business-agent startups emerge — jasonkneen · 2026-07-29
- Recall speeds up RAG with episodic memory, cutting hits to 260ms from 49s — sharpeye_wnl · 2026-07-29
- Agent Wiki 0.8.0 adds multi-vault knowledge bases for agents — HockeyDadNinja · 2026-07-29
- Hamza masks secrets and PII before Claude Code or Codex sends data out — Suitable-Cow2000 · 2026-07-29