Yes — scanning is free for everyone, no credit card, no signup required. Signed-in users get higher rate limits and scan history.

GitHub URLs (github.com/owner/repo), npm packages (scoped or unscoped), PyPI packages, Docker images (Docker Hub or GHCR), and MCP registry IDs (io.github.owner/server). Pin a specific version with @version.

What is the AIVSS score?

AIVSS (AI Vulnerability Scoring System) extends CVSS with agentic-threat factors like tool poisoning, prompt injection, and over-permissive tool access. Scored 0–10 where lower is safer.

How do you reduce false positives?

5 independent LLM judges from multiple providers vote on each finding. We only flag what consensus agrees on — reducing noise from any single model's blind spots.

How fresh are the results?

We fingerprint the commit/version on every request. Previously scanned packages return in under a second from cache; new commits automatically trigger a rescan.

Can I embed a badge in my README?

Yes — every scanned package gets a live SVG badge showing its current grade. See the Badges page for snippets.

Grade backed by static analysis + 5 LLMs

MCP Server Scanner

Is this MCP server safe to install?

Fast verdict in 3 minutes. Deep LLM-judge consensus in 20 minutes. Public packages free; private repos for teams shipping their own.

Scan an MCP server

Free · No credit card required

Built for developers vetting MCP servers before install, and registry operators publishing safe catalogs.

What we detect

Typosquatting

Flags lookalike package names, unverified publishers, and unpinned dependencies before they reach your install chain.

Static analysis

Detects command injection, SQL injection, SSRF, path traversal, and hardcoded secrets — the code-level bugs that turn MCP servers into exploits.

MCP Server Scanner

What we detect

Typosquatting

Static analysis

LLM consensus

Permission audit

How it works

Paste any MCP source

Parallel analysis

Actionable score report

FAQ

Ship safer MCP integrations.

MCP Server Security Scanner

What we detect

Typosquatting

Static analysis

LLM consensus

Permission audit

How it works

Paste any MCP source

Parallel analysis

Actionable score report

FAQ

Ship safer MCP integrations.

MCP Server Scanner