OpenViSTAI · Agents · Blockchain · Crypto
Submit a project
Menu
Agent Security & Sandboxing

MCP Scanner

MCP Scanner is an open-source Python developer tool for scanning Model Context Protocol servers and tools for potential security findings. It offers CLI and REST API modes and combines or independently uses YARA rules, LLM-based analysis and the Cisco AI Defense inspect API.

Explore the practical guide ↓

Independent OpenViST project profile, based on linked sources.

MCP Scanner — OpenViST project profile in Agent Security & Sandboxing.
OpenViST project illustration. See the linked sources for product details.
Understand the project

Practical overview

When it fits

Use it when reviewing an MCP server or its tools for potential threats, adding a security review stage to a development pipeline, or scanning saved JSON data without connecting to a live server.

Who it is for

  • Developers building or maintaining MCP servers and tools.
  • Teams adding MCP security review to development or CI/CD workflows.
  • Security reviewers who need to examine MCP server content, code or dependencies.

Documented uses

  • Scan MCP tools, prompts, resources and server instructions for security findings.
  • Review MCP server source code for potential threats.
  • Check Python dependencies for known vulnerabilities using pip-audit.
  • Inspect server readiness issues such as timeouts, retries and error handling.
  • Scan pre-generated JSON files without a live server connection.
Before you choose

Requirements & limits

The project is open source under the Apache-2.0 license. Installation documentation specifies Python 3.11 or later and uv. Cisco AI Defense, LLM-provider and VirusTotal API credentials are optional for the tool overall, but required for their respective analysis paths.

  • It is a developer tool, not a hosted scanning service: documented modes are a standalone CLI and a REST API server.
  • The three main analysis engines can be used together or independently.
  • Cisco AI Defense API access is needed for the API analyzer; LLM credentials are needed for LLM analysis; VirusTotal credentials are needed for binary malware scanning.
  • Static JSON scanning supports review without live MCP server connections.
  • The README also documents Docker-sandboxed PyPI package scans and pip-audit dependency checks.

Check current requirements in the official documentation. Source-based guidance does not mean OpenViST has run or independently tested this project.

Source-based practical guide

Install MCP Scanner as a CLI tool

Install the scanner using the documented uv tool installation command.

Before you start

  • Python 3.11 or later
  • uv, the Python package manager

Steps

  1. Run the command below.

    Documented command
    uv tool install --python 3.13 cisco-ai-mcp-scanner

  2. Use the installed CLI tool according to the project documentation.

Expected outcome

The MCP Scanner CLI package is installed through uv.

Guide limitations

  • This guide covers installation only, not running a scan.
  • Analyzer-specific credentials may be needed for some scanning engines.
Documentation 1 ↗
Evidence and transparency

Sources & review

Official repository ↗
Source record details
Source availability
Active
Sources checked
12 October 2026
Original website title
cisco-ai-defense/mcp-scanner · Official homepage title · retained in its source language
How we review sourcesSuggest a correction