{
  "markdown": "# MCP Shield\n\n[![CI](https://github.com/sophiacave/mcp-shield/actions/workflows/ci.yml/badge.svg)](https://github.com/sophiacave/mcp-shield/actions/workflows/ci.yml)\n\n\n<!-- mcp-name: io.github.sophiacave/mcp-shield -->\n\n[![License: MIT](https://img.shields.io/badge/License-MIT-purple.svg)](https://opensource.org/licenses/MIT)\n[![Python 3.10+](https://img.shields.io/badge/Python-3.10+-blue.svg)](https://www.python.org/)\n[![Tests: 28 passing](https://img.shields.io/badge/Tests-28%20passing-green.svg)](tests/)\n[![MCP Compatible](https://img.shields.io/badge/MCP-Compatible-orange.svg)](https://modelcontextprotocol.io)\n\n**Open-source security scanner for MCP servers.** 20 rules across 6 categories. Scan any server in seconds. Get a grade from A to F.\n\n> 36.7% of MCP servers are SSRF-vulnerable ([BlueRock, 2026](https://likeone.ai/blog/mcp-server-security-vulnerabilities-2026/)). 82% have path traversal flaws. Only 17% are production-ready. MCP Shield finds the vulnerabilities before attackers do.\n\n## Quick Start\n\n```bash\ngit clone https://github.com/sophiacave/mcp-shield\ncd mcp-shield\n\n# Scan a file\npython3 src/cli.py scan path/to/mcp_server.py\n\n# Scan a project\npython3 src/cli.py scan path/to/mcp-project/\n```\n\n## What It Checks (20 Rules)\n\n| Rule | Severity | What It Detects |\n|------|----------|----------------|\n| SSRF-01 | Critical | User input in HTTP request URLs |\n| SSRF-02 | Medium | Dynamic URLs without validation |\n| SSRF-03 | Medium | DNS rebinding (URL validated but no IP pinning) |\n| PATH-01 | High | User input in file paths |\n| PATH-02 | Medium | No path traversal protection |\n| PATH-03 | Medium | Symlink following without check |\n| INJ-01 | Critical | eval/exec on user input |\n| INJ-02 | Critical | SQL string interpolation |\n| INJ-03 | High | subprocess with shell=True |\n| INJ-04 | High | Template injection via .format() |\n| INJ-05 | Critical | Unsafe deserialization (pickle/yaml) |\n| AUTH-01 | Medium | No auth on tool handlers |\n| AUTH-02 | Critical | Hardcoded secrets/API keys (OpenAI, Stripe, GitHub, AWS) |\n| AUTH-03 | Low | No rate limiting on tool endpoints |\n| SEC-01 | High | SSL verification disabled |\n| SEC-02 | Medium | Wildcard CORS |\n| SEC-03 | Medium | Stack traces/error details exposed to client |\n| SEC-04 | Low | No input length validation (DoS risk) |\n| LOG-01 | Low | No logging/audit trail on tool invocations |\n\n## Testing\n\n```bash\npython3 tests/test_integration.py\n# 28 tests, 0 failures\n```\n\n## MCP Server Integration\n\nAdd to `~/.claude/mcp.json`:\n\n```json\n{\n  \"mcpServers\": {\n    \"mcp-shield\": {\n      \"command\": \"python3\",\n      \"args\": [\"/path/to/mcp-shield/src/mcp_server.py\"]\n    }\n  }\n}\n```\n\nClaude Code tools: `shield_scan_file`, `shield_scan_directory`, `shield_scan_code`\n\n## Example Output\n\n```\nMCP Shield: my-server/ — 3 finding(s)\n\n  [CRIT] SSRF-01: Potential SSRF: Dynamic URL from user input\n    requests call with dynamic URL that may include user input\n    Location: server.py:45\n    Fix: Validate URL against allowlist. Block internal IPs.\n    CWE: CWE-918\n\n  [HIGH] INJ-03: Command injection: subprocess with shell=True\n    subprocess called with shell=True. User input in args = RCE.\n    Location: tools.py:112\n    Fix: Use subprocess with shell=False and pass args as list.\n    CWE: CWE-78\n\n  [MED] AUTH-01: No authentication detected on tool handlers\n    MCP tool handlers found but no auth logic detected\n    Fix: Add authentication middleware.\n    CWE: CWE-306\n\nGrade: F | 1 critical, 1 high, 1 medium\n```\n\n## Features\n\n- **Zero dependencies** — Pure Python, no pip installs required\n- **20 security rules** across SSRF, path traversal, injection, auth, config, and logging\n- **CWE references** — Every finding maps to a Common Weakness Enumeration ID\n- **Actionable fixes** — Each finding includes specific remediation steps\n- **A-F grading** — Instant security posture assessment\n- **Dual mode** — Run as CLI or as an MCP server inside Claude Code\n- **Fast** — Scans a typical MCP server in under 1 second\n\n## Why This Exists\n\nThe MCP ecosystem has 9,400+ servers and 97M monthly SDK downloads. Security tooling hasn't kept up. We built MCP Shield because every MCP server deployed without a security scan is a liability.\n\nBuilt by [Like One](https://likeone.ai), a 501(c)(3) nonprofit. Security tooling should be free.\n\n## License\n\nMIT — [Like One](https://likeone.ai)\n",
  "bytes": 4364,
  "sha": "161698a8411c50bb71a502067b98b7af9943e3ddec2cf847b9b66888609dc21f",
  "repo_slug": "sophiacave/mcp-shield",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_sophiacave_mcp_shield_45d1b0be/readme"
}