MCP Security Auditor
Zero-execution static scanner that audits MCP servers for command injection, path traversal and prompt injection
🔗 Visit MCP Security Auditor
Description
Plugging a new MCP server into your AI agent means trusting code you probably haven't read line by line. MCP Security Auditor reads it for you — without ever running it — and tells you whether it's doing something dangerous like injecting shell commands or leaking credentials.
MCP Security Auditor performs zero-execution static analysis on Model Context Protocol server implementations to catch security flaws before deployment. It inspects abstract syntax trees and configuration patterns to detect five specific vulnerability classes: command injection, path traversal, hardcoded credentials, missing authentication, and prompt injection. Output includes structured JSON findings, a numeric trust score from 0 to 100, a letter grade, and an actionable remediation report. It's delivered as an Apify actor, usable via JavaScript, Python, REST API, the Apify CLI, or a remote MCP server, and billed per audit rather than by subscription.
💬 Our review
The short version: as MCP servers become the default way to plug tools into AI agents, a scanner that checks one before you run it — without executing any of its code — closes a real, currently under-addressed security gap.
Compared to general static analyzers like Semgrep or Bandit, MCP Security Auditor is purpose-built for the specific failure modes of MCP servers (including prompt injection, which generic scanners don't check for at all), at a very low $0.25-per-audit price with no subscription commitment. Its limitation is real too: AST-only analysis can miss vulnerabilities that only show up at runtime, and with just 2 total users reported, it has essentially no independent validation yet. Worth running before adding any third-party MCP server to your stack, given the near-zero cost; not a substitute for a full security review of anything handling sensitive data.
📊 Global score
🤖 AI-enriched data
0,25 $ par serveur MCP audité, sans abonnement ni minimum.
Pros
Analyse zéro-exécution, aucun risque d'exploiter réellement le code audité
Détecte spécifiquement le prompt injection, absent des scanners génériques
Sortie structurée (JSON + markdown) facile à intégrer en CI/CD
Plusieurs modes d'intégration (JS, Python, API REST, CLI Apify, serveur MCP distant)
Cons
Adoption minimale (2 utilisateurs au total, 1 actif par mois)
Aucun avis ou notation utilisateur disponible pour évaluer la fiabilité
L'analyse AST seule peut manquer des vulnérabilités qui n'apparaissent qu'à l'exécution