Opt-in · owner-authorised · evidence first

See what an attacker can make your MCP server do. Before you ship it.

mcpprobe tests MCP servers for the issues in the OWASP MCP and Agentic Top 10, records the real request and response behind every finding, and tells you the fix. Open-source CLI. SARIF for code scanning. A badge your users can check.

v0.1.0
pipx install mcpprobe-scannermcpprobe https://your-server.example/mcp

Package on PyPI · source on GitHub · v0.1.0 release notes

Run your first scanThen follow the quickstartRead the source
passive checks in v0.1.0, mapped to OWASP
16
in the full catalogue, 8 active coming soon
29
median passive scan time
[N]s
HIGHAUTH-01
MCP07:2025 · ASI03

Sample finding

Remote MCP endpoint accepts requests without authentication

Anyone on the internet can list and call your 11 tools, including run_shell. No token was sent and the server answered 200.

→ POST /mcp (no Authorization header)
{"jsonrpc":"2.0","method":"tools/list","id":1}
← 200 OK · 11 tools · 84 ms
{"tools":[{"name":"run_shell", …}, {"name":"read_file", …}]}
FixPut the endpoint behind OAuth 2.1 as the MCP authorization spec describes: return 401 with WWW-Authenticate pointing at RFC 9728 protected-resource metadata, validate token audience, and reject requests without a valid bearer token.
Confidence: high · evidence ev-0005Open full report

One scan, start to finish

The opt-out is checked before the first request. The evidence is the report.

Passive checks read only what your server already shows any client, plus a few benign malformed requests, and never call a tool. Active mode is refused until you name who authorised it, state the scope and verify ownership; the active checks behind that gate are coming soon.

Verify
A DNS TXT record you publish at _mcpprobe.<host>, or local verification for stdio servers you run
Scan
Passive by default; active only with --authorised-by, --scope and --verify, which writes an authorisation record
Fix
Each finding carries the request, the response and the fix; re-run in CI until it passes
Read the scanning policy
Terminal · real run against the scanner's deliberately vulnerable test server, trimmedmcpprobe 0.1.0
$ mcpprobe http://127.0.0.1:8765/mcp
mcpprobe 0.1.0 | passive mode | rate 5.0/s | scan only what you own or are authorised to testtransport=http | revision=2025-11-25 (handshake) | auth=none | server=fake-mcp 0.0.1 | tools=7Findings  critical 0   high 8   medium 5   low 3   info 5
 HIGH    AUTH-01  Remote MCP endpoint accepts requests without authentication HIGH    META-01  Possible tool-description poisoning HIGH    META-05  Secret material in server metadata or configuration HIGH    TRANS-01 Origin header not validated (DNS-rebinding exposure) HIGH    TRANS-03 Forged session ID accepted MEDIUM  ERR-01   Verbose error responses leak stack traces, paths or versions MEDIUM  META-03  Tool annotations contradict the tool's apparent capability …
INJ-01     active  skipped  requires --active and verified ownershipSUPPLY-01  active  skipped  not applicable to http transport38 request/response pairs recorded as evidence.Result: FAIL (findings at or above high)

What it covers

The MCP attack surface, not a generic web scan.

Built on the current MCP spec and the servers people actually run, so it understands tool descriptions, authorization metadata, sessions and transports the way a client does.

Browse all 29 checks
  • AUTH-01..04 · MCP07

    Authentication

    No auth, missing RFC 9728 metadata, no PKCE S256, wrong-audience and query-string tokens

  • META-01..05 · MCP03 · ASI01

    Tool metadata

    Hidden instructions, cross-tool shadowing, invisible Unicode, rug-pull diffs, secrets, lying annotations

  • TRANS-01..05 · MCP07

    Transport

    Origin validation, version handling, session-id quality, deprecated SSE, TLS and headers

  • ERR-01 · DOS-01

    Robustness

    Stack traces in errors; one oversized, one deeply nested and 20 paced requests, never more

  • INJ-01..05 · MCP05 · coming soon

    Injection (active)

    Command, path traversal, SSRF, SQL and tool-output canaries, behind the authorisation gate

  • SUPPLY · SANDBOX · coming soon

    Package and config

    Provenance, risky stdio configs and sandboxed start-up behaviour for stdio packages

Badge and CI

A badge that means something because it expires.

The badge links to a public report page and goes grey after 30 days without a clean scan. Run mcpprobe in GitHub Actions and the SARIF lands in code scanning.

mcpprobepassing · 2d agomcpprobestale · 41d
How the badge is earned
.github/workflows/mcpprobe.yml
- uses: mcpprobe-dev/mcpprobe@v0.1.0
  with:
    target: https://staging.your-server.example/mcp
    fail-on: high
    sarif-output: mcpprobe.sarif
- uses: github/codeql-action/upload-sarif@v3
  if: always()
  with:
    sarif_file: mcpprobe.sarif

How it compares

Other tools exist. Here is where each one fits.

mcpprobe compared with three categories of tool
CapabilitymcpprobeStatic config scannersLLM eval red-teamersEnterprise AI security
Tests the live serverYes, with request and response evidenceReads config and descriptions onlyPrompts, not the MCP protocolYes
MCP authorization spec checksRFC 9728, RFC 8707, PKCE, OriginNoNoVaries
Published false-positive ratePer check, once it has 100 samplesNoNoNo
Price for a 5-person teamFree CLI · £49/month hostedFreeFree tier, cappedQuote only
What it does not doNo runtime proxy, no exploitation, no unverified targets———

Named comparisons, with sources: mcpprobe and mcp-scan · mcpprobe and Cisco mcp-scanner

Your server is already on the internet. Find out what it answers.

Scan your serverSee how a scan works