---
created: 2026-08-08
github: https://github.com/traceforce/mcp-xray
---
**Xia Hua** — co-founder and CEO of Traceforce, which secures AI-native apps running on devices. Previously led engineering at Clumio (acquired by Commvault), delivering cloud data protection products that were 20x faster and 10x more scalable than competitors. Earlier, she was an in-memory database architect at Oracle. PhD in Applied Mathematics from MIT.

**Abhijeet Kumar** — OSCP-certified offensive security researcher and M.Eng Cybersecurity student at the University of Maryland. Has disclosed critical vulnerabilities across NASA, SAIL critical infrastructure, Keurig Dr Pepper, and U.S. government programs, including a CVSS 10.0 RCE that triggered an official CERT-In incident response and a full account takeover chain affecting users across 20+ countries. Captains UMD's CTF team RandomHackers, which placed 1st out of 64 universities at HTB Hack The Madness 2026, and has spoken at the Billington State and Local Cybersecurity Summit alongside the Director of Adversary Emulation.

Audience: AI, Purple Team, Offense/Red Team, AppSec

## Overview

Agents now run with thousands of third-party plugins — MCP servers, Claude skills, GPT actions, IDE extensions, plugin marketplaces — and the prevailing trust model is roughly "read the README and hope." Tool descriptions are executable prompts. Tool parameters are executable code paths. Tool outputs feed straight into the next agent step. Yet there is no npm audit for this ecosystem, no signed manifests, and no capability sandbox in the wild.

MCP X-Ray is an open-source security scanner that ports classical pentest tradecraft to the agent plugin supply chain. It combines static config and repo audit, rules-based and LLM-driven semantic analysis, and active pentesting that actually invokes tools with adversarial inputs — emitting SARIF that drops into GitHub, VS Code, and CI gates today. In this 30-minute session we will (1) walk the threat model that ties MCPs, skills, and plugin bundles together; (2) live-demo X-Ray finding real vulnerabilities in each. Attendees walk away with a CI template they can drop in on Monday, and three intentionally vulnerable plugins to keep practicing on.

## Notes

### Attack Examples
- Tool poisoning: an MCP might be poisoned in files beyond the description
- Parameter injection: instructions might include parameters the agent doesn't validate

### mcp-xray Modes
- **config-scan**: scan MCP configs for security issues; run before pentest to baseline your setup
- **pentest**: execute security test plans by making actual tool calls against MCP servers; LLMs are required to run the pentest; run this before actual production deployment
- **repo-scan**: scan the codebase for vulnerabilities; use when you own or can change the code
- Recommended to run all three modes in sequence

### Tool Notes
- Runs as a CLI tool
- Outputs SARIF format

### Demo Examples
- OAuth MCP server

### From the Repo
- Findings can also be uploaded to Traceforce Atlas, a registry covering 600+ MCPs
- Two analysis methods: token-based pattern matching (default, offline) and LLM-based semantic analysis; supports Claude, OpenAI, and AWS Bedrock as LLM providers
- repo-scan uses software composition analysis plus static/taint analysis via OpenGrep and CodeQL for cross-file vulnerability tracking
- Prerequisite: Go 1.25.4+
- Install: `make install-dependencies` then `make all` to build the binary
- Usage: `./mcpxray config-scan /path/to/config.json`, `./mcpxray pentest /path/to/config.json --llm-model claude-sonnet-4-5`, `./mcpxray repo-scan /path/to/repository`