{"slug": "mcpradar-a-security-scanner-built-for-the-mcp-ecosystem-published-true-tags-mcp", "title": "MCPRadar: A Security Scanner Built for the MCP Ecosystem published: true tags: mcp, security, ai, opensource", "summary": "MCPRadar is an open-source security scanner designed to detect vulnerabilities in Model Context Protocol (MCP) servers, which connect AI agents to external systems. A recent study of nearly 1,900 MCP servers found security issues in about 7% and tool poisoning in another 5%. The tool performs protocol inspection, source analysis, configuration review, supply chain checks, and change monitoring, and integrates into CI pipelines.", "body_md": "Model Context Protocol servers have quickly become the connective tissue between AI agents and the outside world — file systems, databases, APIs, internal tools, you name it. That convenience comes with a catch: the tools, prompts, and schemas an MCP server exposes are a new kind of attack surface, and most traditional scanners simply don't look there. MCPRadar is an open-source project built specifically to close that gap.\n\nWhy this matters\n\nA recent academic study examining nearly 1,900 MCP servers found meaningful security issues in a surprising share of them — general vulnerabilities in roughly 7% and MCP-specific tool poisoning in another 5%. Tool poisoning, prompt injection hidden in tool descriptions, and quietly over-permissioned configurations are easy to miss because they don't look like a \"normal\" vulnerability — there's no CVE, no obvious buffer overflow, just a tool description that quietly tells an agent to do something it shouldn't.\n\nMCPRadar's whole premise is that this class of risk deserves the same rigor as any other part of your CI pipeline.\n\nWhat it actually scans\n\nMCPRadar isn't a single-purpose linter — it looks at an MCP server from several angles:\n\nProtocol inspection — enumerates tools, prompts, resources, and templates the server exposes, and checks server instructions for suspicious content.\n\nSource analysis — walks Python and JavaScript/TypeScript code looking for SSRF, unsafe deserialization, command/SQL injection, Trojan Source tricks, and mismatches between a tool's description and what its code actually does.\n\nConfiguration review — flags poisoned MCP or agent configuration files, risky hooks, and overly broad permission grants.\n\nSupply chain checks — fetches packages without running install scripts, cross-references dependencies against OSV, and can emit a CycloneDX SBOM with hashes and provenance.\n\nChange monitoring — stores snapshots in SQLite and diffs them over time, classifying changes as cosmetic, behavioral, or security-relevant so silent drift doesn't slip past you.\n\nCI integration — outputs JSON, SARIF, or CEF, and supports policy-as-code gates with suppressions for teams that want scanning baked into pull requests.\n\nGetting started\n\nYou don't even need to install it to try it out:\n\nbash\n\nuvx mcpradar scan [http://localhost:8080](http://localhost:8080)\n\nFor repeated use, install the CLI directly:\n\nbash\n\nuv tool install mcpradar\n\nmcpradar --help\n\nIt requires Python 3.11+, and pip install mcpradar works too if you're not on uv.\n\nA few other common workflows:\n\nbash\n\nmcpradar scan \"python ./server.py\" -t stdio --sandbox\n\nmcpradar scan-source ./path/to/server\n\nmcpradar deps npm:@modelcontextprotocol/server-filesystem\n\nmcpradar diff [http://localhost:8080](http://localhost:8080)\n\nmcpradar scan [http://localhost:8080](http://localhost:8080) --format sarif -o mcpradar.sarif\n\nThe security model is refreshingly paranoid — in a good way\n\nMCPRadar treats every server it scans as untrusted input, which is exactly the right instinct for a security tool:\n\nStdio commands won't run on your host unless you explicitly opt in with --allow-host-exec, or better, run them in --sandbox.\n\nSandboxed scans happen in a disposable, non-root container with a read-only filesystem, dropped capabilities, and no host mounts.\n\nSource scans of packages download and inspect archives without ever executing install scripts or server code.\n\nRemote fetches are bounded by URL, redirect, size, and timeout limits, with protections against reaching into private networks.\n\nIf a container genuinely needs network access to pull a package at startup, that's an explicit, opt-in flag (--sandbox-network bridge) rather than a default.\n\nRisk scoring that doesn't oversell itself\n\nFindings roll up into MRS-v1 (MCPRadar Risk Score), a versioned 0–10 signal that factors in findings, confidence, server capabilities, dependency risk, and how much of the server was actually covered by the scan. Importantly, the project is upfront that this is a risk signal, not proof of exploitability — and an incomplete scan is reported as incomplete rather than quietly treated as \"clean.\"\n\nA public leaderboard\n\nThere's also a public leaderboard that publishes reproducible scan results — coverage, findings, and MRS grades — for popular, installable servers from the official MCP Registry, refreshed daily. You can request a server be added by opening a scan request issue; nothing gets executed just by filing the request, and everything is reviewed before it's added.\n\nWorth knowing before you rely on it\n\nThe maintainers are honest about the limits of static, pattern-based detection:\n\nFindings can be false positives and may need contextual review.\n\nAttacks that only manifest at runtime might not show up in a point-in-time scan.\n\nObfuscated or genuinely novel techniques can evade static rules.\n\nThat kind of transparency is refreshing for a security tool, and it's a good reminder that a scanner like this complements manual review rather than replacing it.\n\nTry it\n\nbash\n\nuvx mcpradar scan [http://localhost:8080](http://localhost:8080)\n\nIf you're building or deploying MCP servers — or just plugging third-party ones into your agents — it's worth running a scan before you trust them with real credentials and real data. The project is MIT-licensed and open to contributions if you want to add detection rules or extend coverage.", "url": "https://wpnews.pro/news/mcpradar-a-security-scanner-built-for-the-mcp-ecosystem-published-true-tags-mcp", "canonical_source": "https://dev.to/yatuk/mcpradar-a-security-scanner-built-for-the-mcp-ecosystem-published-true-tags-mcp-security-ai-2pil", "published_at": "2026-07-27 18:26:45+00:00", "updated_at": "2026-07-27 18:31:41.672090+00:00", "lang": "en", "topics": ["ai-safety", "ai-agents", "developer-tools"], "entities": ["MCPRadar", "Model Context Protocol"], "alternates": {"html": "https://wpnews.pro/news/mcpradar-a-security-scanner-built-for-the-mcp-ecosystem-published-true-tags-mcp", "markdown": "https://wpnews.pro/news/mcpradar-a-security-scanner-built-for-the-mcp-ecosystem-published-true-tags-mcp.md", "text": "https://wpnews.pro/news/mcpradar-a-security-scanner-built-for-the-mcp-ecosystem-published-true-tags-mcp.txt", "jsonld": "https://wpnews.pro/news/mcpradar-a-security-scanner-built-for-the-mcp-ecosystem-published-true-tags-mcp.jsonld"}}