MCP Shield

io.github.sophiacavePublished by GitHub account sophiacavev1.0.7Updated Oct 24, 2026

Security scanner for MCP servers. SSRF, path traversal, injection, auth, secrets. Grade A-F.

VerifiedSTDIODesktop onlyDeveloper Tools Security & Monitoring

Server details

Identifier: io.github.sophiacave/mcp-shield
Transport: STDIO
Runtime: Desktop only
Trust: Verified
Published: Sep 16, 2026

Security note

MCP servers receive tool arguments from a conversation and may perform external actions. Review what a server can do before you enable it, and give it only the access it needs.

The registry verified the GitHub account sophiacave for this listing. That does not show the account is the product's maker.

SourceWeft's checks cover whether the listing is complete and the endpoint answered; they do not review the server's code or what its tools do.

Add a badge to your README

Show readers this MCP server is listed on SourceWeft. The badge links to this page.

[![Listed on SourceWeft](https://sourceweft.com/badge/mcp/io.github.sophiacave%2Fmcp-shield.svg)](https://sourceweft.com/mcp/io.github.sophiacave%2Fmcp-shield?utm_source=readme&utm_medium=badge)

Overview

AI-generated overview

A local MCP server that scans MCP server source code for security flaws such as SSRF, path traversal, injection, missing auth and hardcoded secrets, and grades

What you can do: Scan a single source file for security findings with rule IDs, severity, location and CWE references, plus a suggested fix and an A–F grade. Scan a whole project directory the same way. Scan pasted code snippets without a file on disk. Findings cover SSRF, path traversal, injection, authentication, configuration and logging rules.
When to use it: Useful when reviewing or auditing an MCP server's code before deploying it, or when you want a quick security posture check with concrete remediation hints inside an assistant session.
Requirements: Runs as a local process on the user's machine, started with python3 against the project's MCP server script; the README says it is pure Python with no pip installs. Desktop only; no web executable.

Before you install

It reads the source files or code you point it at, so avoid scanning files containing live secrets you do not want surfaced in output. Findings are heuristic rule matches, not a guarantee of security; the A–F grade should not be treated as a certification.

Installation

In SourceWeft

Open MCP Shield in the dashboard and add it to a workspace.
Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

MCP Shield

[CI]

[License: MIT] [Python 3.10+] [Tests: 28 passing] [MCP Compatible]

Open-source security scanner for MCP servers. 20 rules across 6 categories. Scan any server in seconds. Get a grade from A to F.

36.7% of MCP servers are SSRF-vulnerable (BlueRock, 2026). 82% have path traversal flaws. Only 17% are production-ready. MCP Shield finds the vulnerabilities before attackers do.

Quick Start

bash

git clone https://github.com/sophiacave/mcp-shieldcd mcp-shield
# Scan a filepython3 src/cli.py scan path/to/mcp_server.py
# Scan a projectpython3 src/cli.py scan path/to/mcp-project/

git clone https://github.com/sophiacave/mcp-shieldcd mcp-shield
# Scan a filepython3 src/cli.py scan path/to/mcp_server.py
# Scan a projectpython3 src/cli.py scan path/to/mcp-project/

What It Checks (20 Rules)

Rule	Severity	What It Detects
SSRF-01	Critical	User input in HTTP request URLs
SSRF-02	Medium	Dynamic URLs without validation
SSRF-03	Medium	DNS rebinding (URL validated but no IP pinning)
PATH-01	High	User input in file paths
PATH-02	Medium	No path traversal protection
PATH-03	Medium	Symlink following without check
INJ-01	Critical	eval/exec on user input
INJ-02	Critical	SQL string interpolation
INJ-03	High	subprocess with shell=True
INJ-04	High	Template injection via .format()
INJ-05	Critical	Unsafe deserialization (pickle/yaml)
AUTH-01	Medium	No auth on tool handlers
AUTH-02	Critical	Hardcoded secrets/API keys (OpenAI, Stripe, GitHub, AWS)
AUTH-03	Low	No rate limiting on tool endpoints
SEC-01	High	SSL verification disabled
SEC-02	Medium	Wildcard CORS
SEC-03	Medium	Stack traces/error details exposed to client
SEC-04	Low	No input length validation (DoS risk)
LOG-01	Low	No logging/audit trail on tool invocations

Testing

MCP Server Integration

Add to ~/.claude/mcp.json:

json

{  "mcpServers": {    "mcp-shield": {      "command": "python3",      "args": ["/path/to/mcp-shield/src/mcp_server.py"]    }  }}

{  "mcpServers": {    "mcp-shield": {      "command": "python3",      "args": ["/path/to/mcp-shield/src/mcp_server.py"]    }  }}

Claude Code tools: shield_scan_file, shield_scan_directory, shield_scan_code

Example Output

MCP Shield: my-server/ — 3 finding(s)
  [CRIT] SSRF-01: Potential SSRF: Dynamic URL from user input    requests call with dynamic URL that may include user input    Location: server.py:45    Fix: Validate URL against allowlist. Block internal IPs.    CWE: CWE-918
  [HIGH] INJ-03: Command injection: subprocess with shell=True    subprocess called with shell=True. User input in args = RCE.    Location: tools.py:112    Fix: Use subprocess with shell=False and pass args as list.    CWE: CWE-78
  [MED] AUTH-01: No authentication detected on tool handlers    MCP tool handlers found but no auth logic detected    Fix: Add authentication middleware.    CWE: CWE-306
Grade: F | 1 critical, 1 high, 1 medium

MCP Shield: my-server/ — 3 finding(s)
  [CRIT] SSRF-01: Potential SSRF: Dynamic URL from user input    requests call with dynamic URL that may include user input    Location: server.py:45    Fix: Validate URL against allowlist. Block internal IPs.    CWE: CWE-918
  [HIGH] INJ-03: Command injection: subprocess with shell=True    subprocess called with shell=True. User input in args = RCE.    Location: tools.py:112    Fix: Use subprocess with shell=False and pass args as list.    CWE: CWE-78
  [MED] AUTH-01: No authentication detected on tool handlers    MCP tool handlers found but no auth logic detected    Fix: Add authentication middleware.    CWE: CWE-306
Grade: F | 1 critical, 1 high, 1 medium

Features

Zero dependencies — Pure Python, no pip installs required
20 security rules across SSRF, path traversal, injection, auth, config, and logging
CWE references — Every finding maps to a Common Weakness Enumeration ID
Actionable fixes — Each finding includes specific remediation steps
A-F grading — Instant security posture assessment
Dual mode — Run as CLI or as an MCP server inside Claude Code
Fast — Scans a typical MCP server in under 1 second

Why This Exists

The MCP ecosystem has 9,400+ servers and 97M monthly SDK downloads. Security tooling hasn't kept up. We built MCP Shield because every MCP server deployed without a security scan is a liability.

Built by Like One, a 501(c)(3) nonprofit. Security tooling should be free.

License

MIT — Like One

Source: README.md at commit 7064e61

Tools

SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

v1.0.7LatestSep 16, 2026

Score

40% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

Reached in the last 30 days25 pts
Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.
Auth declared10 pts
Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.
Tools listed15 pts
Answer tools/list without a credential, or ship a package that starts in a sandbox without one.
DescriptionRequired15 pts
Logo10 pts
Documentation15 pts
License10 pts
Declare a license in the repository or the registry entry.