Best behavioral analysis for MCP servers. 852 stars. 3 scanning engines (Yara, LLM-as-judge, Cisco AI Defense). Behavioral code analysis detects semantic threats that pattern matching misses. Enterprise-backed, open source.
Where it wins
3 scanning engines: Yara, LLM-as-judge, Cisco AI Defense
Behavioral code analysis detects semantic threats beyond pattern matching
Enterprise-backed by Cisco — credibility with security teams
Open source despite enterprise backing
852 stars — healthy adoption
Where to be skeptical
Smaller community than Tencent AI-Infra-Guard or Snyk Agent Scan
LLM-as-judge engine requires API access
Editorial verdict
#3 agent/MCP security scanner. Best behavioral analysis — 3 scanning engines (Yara, LLM-as-judge, Cisco AI Defense) detect semantic threats that pattern matching misses. 852 stars. Enterprise-backed (Cisco) and open source.
Related
CodeQL (via GitHub MCP Server)
88GitHub-native SAST via CodeQL, accessible through the official GitHub MCP Server. Copilot Autofix generates fixes from CodeQL alerts. GitHub Security Lab Taskflow Agent found ~30 real CVEs. Zero extra setup for GitHub users.
TruffleHog
8818K+ stars. 800+ secret types. Unique credential verification — confirms if leaked creds are still active. Scans S3, Docker, Slack — not just git. No official MCP but community integrations exist.
Gitleaks
8824.4K stars — most-starred secret scanner. 150+ patterns. Fastest pre-commit scanner. The community default for pre-commit secret detection. No official MCP.
Tencent AI-Infra-Guard
81Most comprehensive OSS AI red teaming tool. 3,264 stars. Full-stack: ClawScan, Agent Scan, Skills Scan, MCP scan, jailbreak eval. 43 AI framework components, 589 CVEs cataloged. v4.0 released.
Public evidence
Enterprise-backed OSS MCP scanner with unique behavioral analysis. 3 engines (Yara, LLM-as-judge, Cisco AI Defense) catch semantic threats pattern matching misses.
Raw GitHub source
Constrained peek so you can sanity-check the source material without leaving the site.
A Python tool for scanning MCP (Model Context Protocol) servers and tools for potential security findings. The MCP Scanner combines Cisco AI Defense inspect API, YARA rules and LLM-based analysis to detect malicious MCP tools.
The MCP Scanner provides a comprehensive solution for scanning MCP servers and tools for security findings. It leverages three powerful scanning engines (Yara, LLM-based analysis, Cisco AI Defense) that can be used together or independently.
The SDK is designed to be easy to use while providing powerful scanning capabilities, flexible authentication options, and customization.
2026-07-28 via server/discover) with automatic fallback to legacy initialize() for older servers — remote HTTP/SSE and stdio.mcp>=2.0.0, bundled with this package). Live scans negotiate 2026-07-28 when the server supports it and fall back to legacy handshake versions automatically.uv tool install --python 3.13 cisco-ai-mcp-scanner
Alternatively, you can install from source:
uv tool install --python 3.13 --from git+https://github.com/cisco-ai-defense/mcp-scanner cisco-ai-mcp-scanner
git clone https://github.com/cisco-ai-defense/mcp-scanner
cd mcp-scanner
uv sync --python 3.13
Live scans (remote HTTP/SSE and stdio) negotiate the MCP protocol version automatically:
server/discover first. Servers built with the current Python SDK (MCPServer) typically respond with protocol version 2026-07-28.discover is unavailable or the server only supports handshake-era versions, the scanner falls back to initialize() (for example 2024-11-05, 2025-06-18, 2025-11-25).The Python MCP 1.x stdio server reports an unknown server/discover request as
a generic -32602 invalid-parameters error. The scanner retries initialize()
for that specific stdio error shape and logs a warning. Other -32602 errors
surface to the caller so malformed modern discovery is not silently downgraded.
Example servers under examples/ and eval fixtures use MCPServer from mcp.server.mcpserver (mcp 2.0). The static/behavioral analyzers still recognize legacy FastMCP patterns in third-party source code for capability extraction.
Integration tests: uv run pytest tests/test_stdio_modern_integration.py tests/test_scanner.py -k negotiate
For an unauthenticated HTTP endpoint, run read-only wire-protocol probes with
mcp-scanner protocol --server-url https://your-server.example/mcp. This checks
modern request envelope headers on servers advertising 2026-07-28 and runs
safe legacy checks for older endpoints. It does not call tools or prove
that unauthenticated callers can invoke them. A protected endpoint may require
separate authorized testing to assess its behavior after authentication.
The opt-in schema analyzer classifies nested $ref values in advertised
tool input and output schemas. Use --analyzers schema to run this check,
including with the static --tools mode. See
MCP 2.0 threat coverage
for the scan-time and runtime boundary.
Add MCP Scanner as a dependency using uv. From your project root (initialize with uv if needed):
uv init --python 3.13 #if not already done
uv add cisco-ai-mcp-scanner
# then activate the virtual environment:
## macOS and Linux: source .venv/bin/activate
## Windows CMD: .venv\Scripts\activate
## Windows PWSH: .venv\Scripts\Activate.ps1
uv sync
The module name is mcpscanner. Import this module with:
# import everything (not recommended)
import mcpscanner
# selective imports (recommended). For example:
from mcpscanner import Config, Scanner
from mcpscanner.core.models import AnalyzerEnum
Cisco AI Defense API (only required for API analyzer)
export MCP_SCANNER_API_KEY="your_cisco_api_key"
export MCP_SCANNER_ENDPOINT="https://us.api.inspect.aidefense.security.cisco.com/api/v1"
# For other endpoints please visit https://developer.cisco.com/docs/ai-defense/getting-started/#base-url
Tested LLMs: OpenAI GPT-4o and GPT-4.1 | AWS Bedrock Claude 4.5 Sonnet