🚀 What is Scanorama?

Scanorama is a powerful command-line interface (CLI) tool designed for security professionals and developers to statically analyze MCP server. It intelligently scans MCP server source code searching for malicious or unsafely MCP servers.

MCP tools descriptions, when consumed by Large Language Model (LLM) agents, can be a vector for prompt injection attacks, leading to unintended agent behavior, data exfiltration, or other security risks. Scanorama helps you identify these threats proactively.

Understanding and Mitigating Prompt Injection in MCP-based Agents

https://github.com/user-attachments/assets/c912b358-afdf-4cd7-85ea-c461907e9a67

Key Features:

• 🔎 Deep Code Analysis: Semantically understands code (not just syntactically)
• 🎯 Prompt Injection Detection: Leverages LLMs to analyze extracted tool descriptions for common and sophisticated prompt injection patterns.
• 💻 Multi-Language Support: Works with all MCP SDKs: Python, TypeScript, Java, Kotlin, C#...

scanorama --clone https://github.com/someuser/vulnerable-mcp-tools.git --provider google --model gemini-1.5-flash-latest --output gemini_report.json

• 🔗 Flexible Source Input: Scan local directories or directly clone and analyze public GitHub repositories.

scanorama --path /path/to/your/mcp-project

• 📄 Clear Reporting: Generates easy-to-understand console reports

• 💾 JSON Output: --ouput filename

• 🤖 Multi-Provider LLM Support: Choose from a range of LLM providers --list-models

  • -m, --model <id>: Specify the model ID for the chosen provider.

    • For OpenAI, Google, Anthropic: Use a model ID like gpt-4o, gemini-1.5-flash-latest, claude-3-haiku-20240307.
    • For Azure: This must be your specific Deployment ID.

• ⚙️ Configurable Analysis: Adjust LLM temperature and select specific models.

What is MCP?

The Model Context Protocol (MCP) is an emerging open standard that defines a universal interface for connecting Large Language Models (LLMs) to external data sources, tools, and services. The most popular standardized way for LLMs to interact with the outside world. You can see more here

⚠️ Why scan MCP servers ?

While MCP offers great flexibility, it also introduces a new attack surface. The descriptions of MCP tools can be injected directly into an LLM agent's context (prompt) and it allows third party agents take control of your agents.

A maliciously crafted tool description can contain hidden instructions designed to:

• Hijack the agent's original purpose.
• Exfiltrate sensitive data processed by the agent.
• Instruct the agent to perform unauthorized actions.
• Manipulate other tools or data sources the agent interacts with.

This is a form of prompt injection. Scanorama helps you identify such potentially "poisoned" tool descriptions before they can cause harm.

Research about how MCP tool description can be exploited to take control of LLM agents: Understanding and Mitigating Prompt Injection in MCP-based Agents

💻 Installation

You can install Scanorama using npm:

npm install -g @telefonica/scanorama

Veri

... View full README on GitHub