Show HN: Get a security assessment of MCP servers directly from your terminal

Canopii released a deterministic CLI scanner that catches command injection, prompt-injection markers, over-broad tools, and committed secrets in MCP servers before connection. The tool, available under Apache 2.0 on GitHub, continuously scans the official MCP registry and can be integrated into CI/CD pipelines with a minimum grade option. No telemetry or account is required.

I built a deterministic scanner that catches command injection, prompt-injection markers in tool descriptions, over-broad/destructive tools, and committed secrets in MCP servers before you connect them. It continuously scans the entire official MCP registry and makes results available at https://index.canopii.dev https://index.canopii.dev . Now the engine behind that scanner is available as a CLI that you can integrate into your processes and CI/CD pipelines e.g --min-grade B . If you are building MCP servers, you can make sure your MCP server is secure using the local mode before publishing it. Or check why your server scored low, apply fixes, check if your score has improved locally first before publishing a new version so as to eliminate guesswork. If you are a user, easily check the security of an MCP server before connecting your AI agents using one of the available methods remote, github, pypi, npm etc. You can also use an LLM as a "judge". It won't affect the score but it may flag important security considerations that a deterministic scanner can't catch. No telemetry, no account necessary. Github: https://github.com/canopii-dev/canopii-cli https://github.com/canopii-dev/canopii-cli license: Apache 2.0 Comments URL: https://news.ycombinator.com/item?id=49094760 https://news.ycombinator.com/item?id=49094760 Points: 1 Comments: 0