# ๐ก๏ธ mcp-safeguard
**The security scanner for MCP servers.**
Detect prompt injection ยท credential leaks ยท exposed endpoints ยท tool poisoning
Maintained by [Syed Anas Mohiuddin](https://cognivators.com/founder) at [Cognivators](https://cognivators.com). Public vulnerability record: [cognivators.com/research](https://cognivators.com/research)
> ๐ **Found [CVE-2026-14540](https://github.com/googleapis/mcp-toolbox/pull/3448) โ a server-side request forgery in Google's official MCP Toolbox. Google shipped the fix and credited the report.**
[](https://pypi.org/project/mcp-safeguard/)
[](https://github.com/googleapis/mcp-toolbox/pull/3448)
[](https://doi.org/10.5281/zenodo.20502474)
[](https://www.python.org/downloads/)
[](https://opensource.org/licenses/MIT)
[](https://mcpservers.org/servers/syedanas01/mcp-safeguard)
[](https://gitlab.com/anasmohiuddinsyed/mcp-safeguard)
```bash
pip install mcp-safeguard
mcp-safeguard scan your-config.json
```
---
## 30-Second Demo
```bash
pip install mcp-safeguard
git clone https://github.com/SyedAnas01/mcp-safeguard && cd mcp-safeguard
mcp-safeguard scan examples/demo-vulnerable-config.json
```
```
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
โ mcp-safeguard โ MCP Security Scanner โ
โ github.com/SyedAnas01/mcp-safeguard โ
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
Scanning: examples/demo-vulnerable-config.json
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
[CRITICAL] CRED-007 AWS Access Key ID
Location: env.AWS_ACCESS_KEY_ID
Evidence: AKIA************MPLE
CVSS: 9.9
Fix: Rotate AWS credentials. Use IAM roles.
[CRITICAL] PI-011 Data Exfiltration Instruction
Location: tool:run_query โ description
Evidence: send_data
CVSS: 9.5
Fix: Immediately audit โ designed to exfiltrate data.
[HIGH] TP-002 Covert Operation Descriptor
Location: tool:summarize_document.description
Evidence: |MCP over SSE/stdio| D
D --> E & F & G
E --> M --> N --> O
E --> H & I & J & K & L
H & I & J & K & L --> Q & R
```
---
## Why This Matters
External research confirms the threat is real: [MCPTox (2025)](https://arxiv.org/abs/2504.03711) found a **72% attack success rate** across 45 production MCP servers, demonstrating that tool poisoning and prompt injection attacks are actively exploitable in today's MCP ecosystem.
OWASP officially added **MCP Tool Poisoning** to their 2026 threat guidance โ the same vulnerability category mcp-safeguard's `TP-*` rules detect.
**The gap**: The MCP ecosystem grew from zero to 10,000+ servers in 18 months while security tooling lagged behind. mcp-safeguard is an open-source scanner built specifically for MCP's attack surface โ tool definitions, server configs, and SSRF exposure via prompt injection.
The vulnerability patterns mcp-safeguard detects are documented with illustrative examples in [SECURITY-HALL-OF-SHAME.md](SECURITY-HALL-OF-SHAME.md). Run mcp-safeguard on your own servers and contribute real scan results via GitHub Issues or Discussions.
Share your results โ open a [Discussion](https://github.com/SyedAnas01/mcp-safeguard/discussions) or submit a PR to SECURITY-HALL-OF-SHAME.md.
---
## Project Resources & Standards Work
### ๐ฐ Community & Standards
- **[Hacker News](https://news.ycombinator.com/item?id=48242541)** โ "MCP-safeguard: Security scanner for MCP servers" (2026-05-22)
- **[IETF Internet-Draft](https://datatracker.ietf.org/doc/draft-mohiuddin-mcp-security-considerations/)** โ draft-mohiuddin-mcp-security-considerations-00, security considerations for the Model Context Protocol
- **OWASP MCP Top 10** โ Open PR adding an SSRF prevention/detection recommended control ([PR #42](https://github.com/OWASP/www-project-mcp-top-10/pull/42), under review)
### ๐ Real-World Fixes Credited
- **googleapis/mcp-toolbox** โ SSRF via redirect chain (CWE-918, fix in [PR #3448](https://github.com/googleapis/mcp-toolbox/pull/3448), reported by Syed Anas Mohiuddin) โ credited with [CVE-2026-14540](https://www.cve.org/CVERecord?id=CVE-2026-14540)
- **github/github-mcp-server** โ GitHub token was attached to requests regardless of destination host; fix in [PR #3056](https://github.com/github/github-mcp-server/pull/3056), merged 2026-08-18, authored by Syed Anas Mohiuddin
Using mcp-safeguard in your pipeline, or found a real issue with it? We welcome scan results and contributions โ open a [Discussion](https://github.com/SyedAnas01/mcp-safeguard/discussions) or PR.
---
## Roadmap
- [x] **v0.2** โ Tool poisoning detection; CVSS scoring; JSON + Markdown output; batch scanning
- [x] **v0.3** โ SSRF detection module (SS-001โ003); MCP server dog-fooding
- [ ] **v0.4** โ Scan over MCP stdio transport directly; VS Code extension; GitHub Actions plugin
- [ ] **v0.5** โ AI-assisted remediation (Claude generates fixes); SBOM for tool supply chain
- [ ] **v1.0** โ SOC2/compliance report templates; MCP registry bulk scanning
---
## Contributing
```bash
git clone https://github.com/SyedAnas01/mcp-safeguard
cd mcp-safeguard
python -m venv .venv && source .venv/bin/activate
pip install -e ".[dev]"
pytest tests/ -v
```
Issues and PRs welcome โ especially:
- New injection patterns you've seen in the wild
- Credential types not yet covered
- Integrations with other MCP clients
- Scan results from your own MCP servers (add to SECURITY-HALL-OF-SHAME.md)
- OWASP MCP Top 10 rule mappings
---
## License
MIT โ see [LICENSE](LICENSE).
---
**If this helped you, please โญ the repo โ it helps others find it.**
[GitHub](https://github.com/SyedAnas01/mcp-safeguard) ยท [PyPI](https://pypi.org/project/mcp-safeguard/) ยท [Issues](https://github.com/SyedAnas01/mcp-safeguard/issues)