Mcpshield

io.github.MCPShield-DevPublished by GitHub account MCPShield-Devv2.0.2Updated Oct 24, 2026

Security scanner for MCP servers - detects tool poisoning and injection

VerifiedSTDIODesktop onlyDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

MCPShield CLI is a local command-line security scanner that checks MCP servers and GitHub repositories for tool poisoning and injection risks.

What you can do
  • Scan remote HTTP MCP servers by URL for security vulnerabilities
  • Scan GitHub repositories for security issues
  • Filter findings by severity and emit JSON output for CI/CD pipelines
  • Report results through exit codes distinguishing clean, error and critical-finding outcomes
  • Authenticate with an API key, optionally pointing at a self-hosted API endpoint
When to use it
Useful when you want to vet an MCP server or repository before connecting it to an assistant, or when you want automated security checks of MCP endpoints in a CI/CD pipeline.
Requirements
Runs as a local process installed from the npm package mcpshield-cli, so Node.js is needed. A free API key is required, supplied via the auth command or the MCPSHIELD_API_KEY environment variable; MCPSHIELD_API_URL can point to a self-hosted endpoint. Network access to the scanning service and to the targets being scanned.
Before you install
The API key is a credential: it is stored by the auth command or passed in MCPSHIELD_API_KEY, so keep it out of shared configs and logs. Scanned URLs and repository addresses are sent to the MCPShield service, which may be a third party unless you self-host. Exit code 1 covers invalid keys, rate limits and scan failures, so treat it as an error rather than a clean result.

Installation

In SourceWeft

  1. Open Mcpshield in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

MCPShield CLI

Scan MCP servers and GitHub repositories for security vulnerabilities.

Powered by MCPShield — the MCP security scanner with 59+ detection rules covering the OWASP MCP Top 10.

Install

bash
npm install -g mcpshield

Setup

Get a free API key at mcpshield.co/settings, then:

bash
mcpshield auth mcp_sk_your_key_here

Usage

bash
# Scan an HTTP MCP servermcpshield scan --url https://mcp-server.example.com/mcp
# Scan a GitHub repositorymcpshield scan --github https://github.com/user/repo
# JSON output (for CI/CD)mcpshield scan --url https://mcp-server.example.com/mcp --json
# Filter by severitymcpshield scan --url https://mcp-server.example.com/mcp --severity high

Exit Codes

  • 0 — Scan completed, no critical findings
  • 1 — Error (invalid key, rate limit, scan failure)
  • 2 — Scan completed with critical findings

Environment Variables

  • MCPSHIELD_API_KEY — API key (alternative to mcpshield auth)
  • MCPSHIELD_API_URL — Custom API endpoint (for self-hosted)

License

MIT

Source: README.md at commit bdfa0f1

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v2.0.2LatestSep 16, 2026

Score

40% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts

    Declare a license in the repository or the registry entry.