Free tool

MCP Security Scanner

Before you point an agent at an MCP server, see what it is asking for. Graded A–F on transport, authentication, tool-poisoning markers and dangerous parameters.

Scan a server you own, or one you are considering connecting. For example https://mcp.example.com/mcp
This server needs authentication
Used for this one request and never stored.

You checked the server. Who checks the demo?

If you publish an MCP server, prospects run scans like this one before they trust you. MCP Showcase gives them a live playground and per-tool documentation, so what your server does is obvious rather than something they have to audit.

How it works

link
Paste the server URL

Yours, or one you are evaluating. Nothing is installed and no tool is ever called.

play_circle
We read what it advertises

One handshake, then every tool description and input schema is checked against known MCP attack patterns.

checklist
Get a graded report

An A–F grade, each finding ranked by severity with what to do about it, and the list of checks that passed.

What this MCP security scanner checks

Paste a Model Context Protocol endpoint above and this scanner performs one MCP handshake, reads everything the server advertises, and grades it from A to F. It never calls a tool. The whole report is built from what the server volunteers during the same exchange any MCP client performs when it connects.

Tool poisoning, and why descriptions are a security surface

A tool's description is not documentation for a human. It is passed to the model verbatim and read as instruction. That makes it an injection point: text such as "ignore previous instructions", "do not tell the user", or a request to read ~/.ssh can be planted in a description and acted on by the agent without the person ever seeing it. This is the attack class usually called tool poisoning, and it is specific to MCP in a way that conventional application scanning does not cover.

The scanner matches every tool name, description and input-schema description against the patterns this attack takes, and reports the tool it found them in.

The rest of the report card

  • Transport — an endpoint served over plain HTTP exposes every request, including the bearer token an agent sends. This alone caps the grade.
  • Authentication — whether the full tool list can be enumerated with no credential at all. Fine for a genuinely public read-only server; serious if the tools write data, spend money or reach internal systems.
  • Dangerous parameters — tools that accept a free-text command, a raw sql string, or an unconstrained filesystem path. Each is a route from "the agent was persuaded" to "something ran on the host".
  • Destructive operations — MCP has no built-in confirmation step, so whether a human approves a delete is entirely up to the client.
  • Schema hygiene — tools with no declared properties accept whatever the model invents, and tools with no usable description get called by guesswork.

What an A grade does and does not mean

It means nothing is visibly wrong from the outside. Because no tool is ever invoked, the scanner cannot tell you whether a tool validates its input, enforces authorisation, or does what its description claims once called. Treat the grade as a first pass that catches the MCP-specific mistakes cheaply — not as an audit, and not as something to publish as one. The limits are printed on every result for exactly this reason.

Related tools and guides

If you publish an MCP server, expect to be scanned

Anyone evaluating your server will run something like this before they connect an agent to it, and a wall of JSON schemas gives them no reason to trust you. MCP Showcase turns the same endpoint into a live playground with per-tool documentation, so what your server does is obvious on sight rather than something a prospect has to reverse-engineer.

Frequently asked questions

A tool description is fed to the model verbatim, so it is read as instructions. Tool poisoning is the technique of hiding instructions in that description — "ignore previous instructions", "do not tell the user", or a request to read ~/.ssh — so the agent acts on them without the user ever seeing the text. This scanner flags descriptions that contain that kind of language.

Four things the server reveals from the outside: whether the transport is encrypted, whether the tool list is exposed without authentication, whether any tool description contains instruction-like text, and whether any tool takes a dangerous parameter such as a free-text shell command, a SQL string or an unconstrained filesystem path.

No, and the report says so on the result itself. No tool is ever called, so the scanner cannot tell you whether a tool validates its input or what it does once invoked. An A means nothing is visibly wrong from the outside — it is not an audit and should not be presented as one.

Yes. The scan does exactly what any MCP client does when it connects — a handshake and a tools/list call — and never invokes a tool. That is the same traffic the server already accepts from every agent that uses it.

For a genuinely public read-only server it may be fine, which is why it is reported rather than treated as a failure. But if the tools write data, spend money or reach internal systems, anyone who discovers the URL can enumerate and call them.

More free MCP tools