AgentsID Scanner

The Lighthouse of agent security.
Scan any MCP server. Get a security report card.

---

Your MCP server exposes tools to AI agents. How secure is it?

Most MCP servers ship with no authentication, no per-tool permissions, no input validation, and tool descriptions vulnerable to prompt injection. You just don't know it yet.

AgentsID Scanner tells you.

Quick Start

npx @agentsid/scanner -- npx @some/mcp-server

That's it. You get a letter grade and detailed findings.

What It Scans

Category	What It Checks	Why It Matters
Injection	Tool descriptions for 11 prompt injection patterns	Malicious tool descriptions can hijack agent behavior
Permissions	Tool names classified by risk (destructive, execution, financial, credential)	50 tools with no access control is a 50-surface attack
Validation	Input schemas for missing constraints, unbounded strings, optional-only params	No validation = arbitrary input to your tool handlers
Auth	Authentication indicators in tool surface	No auth tools = unauthenticated agents calling your tools
Secrets	Tools that may expose credentials in output	API keys, tokens, passwords leaked in responses
Output	Unfiltered file/data output	Sensitive file contents returned without redaction

The Report

╔══════════════════════════════════════════════════════════════╗
║          AgentsID Security Scanner — Report                  ║
╚══════════════════════════════════════════════════════════════╝

Server: my-mcp-server v1.0.0
Tools:  23
Scanned: 2026-03-29T12:00:00.000Z

Overall Grade: D (42/100)

Category Grades:
  injection       A
  permissions     F
  validation      D
  auth            F
  output          B

Tool Risk Profile:
  destructive          ████ 4
  execution            ██ 2
  credential_access    █ 1

Findings: 31
  CRITICAL: 2
  HIGH: 8
  MEDIUM: 15
  LOW: 6

Recommendations:
  1. Address CRITICAL and HIGH findings immediately
  2. Add per-tool permission controls (agentsid.dev/docs)
  3. Implement input validation on all tool parameters
  4. Add authentication to server endpoints

Usage

Scan a local MCP server (stdio)

# Scan any npx-installable MCP server
agentsid-scan -- npx @modelcontextprotocol/server-filesystem ./

# Scan a local server file
agentsid-scan -- node my-server.mjs

# Scan a Python MCP server
agentsid-scan -- python -m my_mcp_server

Scan a remote MCP server (HTTP)

agentsid-scan --url https://mcp.example.com/mcp

JSON output

agentsid-scan --json -- npx @some/mcp-server > report.json

Pass environment variables

agentsid-scan --env API_KEY=xxx --env DB_URL=postgres://... -- node server.mjs

Grading (v2 — normalized + capped)

Starts at 100 points. Deductions per finding:

Severity	Deduction	Normalization	Cap
CRITICAL	-25 each	Absolute — always hits full	Uncapped
HIGH	-15 each	Absolute — always hits full	-45 max
MEDIUM	-8 each	Divided by √(tool count)	-25 max
LOW	-3 each	Divided by √(tool count)	-15 max
INFO	0	—	—

MEDIUM and LOW findings are normalized by tool count so a per-tool issue (e.g. missing maxLength on every input) doesn't compound linearly with server size. A 50-tool server with 50 LOWs scores the same as a 5-tool server with 5 LOWs. CRITICALs and HIGHs stay absolute — real vulnerabilit

... View full README on GitHub