mcprobe
A free command-line scanner that checks MCP servers — the plugins AI agents connect to — for hidden dangers like prompt injection or path traversal before you let an AI agent talk to them.
🔗 Visit mcprobe
Description
When you connect an AI agent to a new tool or plugin (an "MCP server"), you're trusting that its description and behavior are exactly what they claim to be. That trust can be abused: a malicious or careless MCP server can smuggle hidden instructions into its tool descriptions to manipulate the AI, or expose file paths and resources it shouldn't. mcprobe is a scanner that inspects an MCP server's tool descriptions, schemas, and resource URIs and flags that kind of problem before you plug it into a live agent.
It's a single, dependency-free binary that ships as open source under the MIT license. It detects 18 distinct prompt-injection patterns, checks for "tool shadowing" (where one server's tools silently override another's), flags path-traversal and resource-exposure issues, and can snapshot a server's current state as a baseline to detect configuration drift later. Results can be exported as SARIF for CI/CD pipelines, and it supports stdio, HTTP, and SSE transport types — covering the common ways MCP servers are actually deployed.
💬 Our review
The short version: if you or your team are wiring AI agents up to third-party MCP servers, mcprobe is a free, five-minute sanity check that catches a real and growing class of attack (prompt injection hidden in tool metadata) before it reaches production.
It's not really competing with general code-security scanners like Semgrep or Snyk Code — those look at source code for known vulnerability patterns, while mcprobe looks specifically at the MCP protocol surface (tool descriptions, schemas, resource URIs) that general scanners don't understand. That narrow focus is the value: it's a single static binary you can drop into a CI pipeline in minutes, with zero cost and zero external dependencies. The tradeoff is that it only covers MCP-specific risks — it won't catch a vulnerability in the server's actual implementation code, so it belongs alongside a general scanner, not instead of one.
💰 Pricing
📊 Global score
🤖 AI-enriched data
Binaire unique, licence MIT, aucun coût ni dépendance externe.
Pros
Détecte 18 patterns d'injection de prompt dans les métadonnées d'outils MCP
Binaire unique, zéro dépendance, intégrable en CI/CD (sortie SARIF)
Gratuit et open source (MIT)
Cons
Ne couvre que la surface MCP, pas le code d'implémentation du serveur lui-même
Outil jeune et de niche, écosystème/communauté encore restreints
Nécessite de comprendre le protocole MCP pour interpréter certains résultats