agent-security-scanner-mcp

Security scanner for AI coding agents, MCP servers, prompts, and AI-suggested packages.

Run it before Claude Code, Cursor, Windsurf, Cline, OpenCode, or another agent trusts new code, tools, prompts, or dependencies.

Copy-Paste Start

Scan any repo and get an A-F agent security grade:

npx agent-security-scanner-mcp scan-project . --verbosity compact

Install the scanner into your AI coding client:

npx agent-security-scanner-mcp init claude-code

Replace claude-code with cursor, claude-desktop, windsurf, cline, kilo-code, opencode, or cody.

Audit an MCP server before adding it to an agent:

npx agent-security-scanner-mcp scan-mcp ./path/to/mcp-server --verbosity compact

Check AI-generated imports for package hallucinations:

npx agent-security-scanner-mcp scan-packages ./src/app.ts npm --verbosity compact

What It Catches

Screenshots

Project Scan

MCP Server Audit

Package Hallucination Detection

Demos

Run a safe local demo that creates intentionally vulnerable fixtures, scans them, and cleans them up.

# MCP audit demo: tool poisoning, spoofed tool name, command execution, secret exposure
npx agent-security-scanner-mcp demo --type mcp --no-prompt

# Package hallucination demo: real imports mixed with fake AI-generated package names
npx agent-security-scanner-mcp demo --type packages --no-prompt

Expected demo shape:

{
  "grade": "F",
  "findings_count": 8,
  "findings": [
    {
      "rule": "mcp.description-injection",
      "severity": "ERROR",
      "message": "Tool description contains imperative language directed at the LLM."
    },
    {
      "rule": "mcp.tool-name-spoofing",
      "severity": "ERROR",
      "message": "Tool name is close to a well-known MCP tool name."
    }
  ]
}

Install In Your Agent

npx agent-security-scanner-mcp init claude-code

... View full README on GitHub