MCPSafe.io
RegistryThreatsMethodologyDocsPricingScanSign in
⌘K
  • Getting Started
  • Quickstart

API Reference

  • Overview
  • POST /scan
  • GET /scan/:id
  • Private scans
  • Team & billing

Integrations

  • GitHub Actions
  • Cursor
  • Claude Code

Concepts

  • AIVSS Scoring
  • Findings
  • Severity Levels
  • CLI
  • Troubleshooting
  • FAQ
⌘K
MCPSafe.io

Security checks for MCP servers — public packages and private repos, fast or deep.

Legal

Privacy PolicyCookie PolicyTerms of ServiceSecurity disclosure

Resources

State of MCP SecuritySupportSystem statusMade in Germany 🇩🇪

© 2026 MCPSafe. All rights reserved.

GDPR — Privacy Policy

Getting Started

MCPSafe scans MCP servers for security vulnerabilities — free, no account needed.

MCPSafe is a security scanner for Model Context Protocol (MCP) servers. Paste a package name, GitHub URL, or registry ID and get a full security report in seconds.

What MCPSafe checks

Coverage spans the MCP Top-10 risks, including:

CategoryWhat it finds
Destructive toolsMutating tool handlers without elicit(), dry_run, or confirmation flags
Secret exfiltrationEnv vars, KMS plaintext, or OAuth tokens reaching response/log sinks
PermissionsIAM wildcards, OAuth over-scoping, and unused-scope detection
Prompt injectionUser-controlled input flowing into inner-LLM SYSTEM messages
Schema riskOverbroad string schemas on command/query/url/code fields
Supply chainTyposquat package names, install-time remote-exec hooks, plaintext secrets in .env, container running as root
Known CVEsNVD / GHSA matches against the resolved version

The live rule list is at /threats/coverage.

Scan modes

ModeTypical runtimeIncludes
Fast≤ 20 min (target p95 < 3 min)Static + manifest + supply-chain checks
Deep≤ 30 min (target p95 < 20 min)Everything in Fast + LLM judge panel (5 models)

Deep scans add a second-opinion model consensus on each tool handler. Model votes adjust the score; rule findings drive the verdict. See Methodology for the full breakdown.

Input formats

Paste any of the following into the scan box. The parser resolves bare names, URLs, version constraints, and official registry IDs. The full reference (with every variant) lives in Methodology — Supported targets.

npm

InputResolves to
expresslatest version on npm
@modelcontextprotocol/sdkscoped package, latest
npm:fastifyexplicit prefix, latest
npm:lodash@4.17.21pinned version
https://www.npmjs.com/package/expressnpm URL, latest

PyPI

Bare names default to npm. Use the pypi: prefix or a version constraint to target PyPI.

InputResolves to
pypi:requestslatest on PyPI
pypi:mcpAnthropic MCP Python SDK, latest
requests==2.31.0pinned — == operator detected as PyPI
mcp>=1.0.0range constraint, scans latest matching
https://pypi.org/project/mcp/PyPI URL, latest

GitHub

InputResolves to
modelcontextprotocol/serversHEAD of default branch
github:modelcontextprotocol/serversexplicit prefix, HEAD
https://github.com/modelcontextprotocol/serversGitHub URL, HEAD
https://github.com/modelcontextprotocol/servers/tree/v1.2.0pinned tag

Docker

InputResolves to
nginx:latestDocker Hub image with tag
docker:mcp/fetchexplicit prefix, resolves :latest
ghcr.io/owner/image:tagGitHub Container Registry
mcr.microsoft.com/mcp-server:latestMicrosoft Container Registry
nginx@sha256:abc123pinned digest

Official MCP Registry

Reverse-domain IDs from registry.modelcontextprotocol.io. io.github.* IDs resolve to the underlying GitHub repo via the registry, pinned to the registry's current release.

InputResolves to
io.github.modelcontextprotocol/serversrepo + version from MCP registry
ai.anthropic/claude-codenon-GitHub registry server ID
https://registry.modelcontextprotocol.io/servers/io.github.punkpeye/fastmcpfull registry URL
✦

No account needed

Public scans are free and require no sign-up. Create an account for scan history, API access, and higher rate limits.

Private scans

Scan a package or repository without publishing the result. Results stay private to your account and never appear in the public registry. Available on Developer, Team, and Business plans.

Supported targets: private GitHub repos, private npm packages, private PyPI packages, private Docker Hub images, and private GHCR images — submitted with a read-only token (Docker Hub and GHCR also need a username). Self-hosted Git providers and custom registries are on the roadmap.

Credentials are encrypted in transit and at rest, scoped to a single scan, and never logged. See Private scans for token formats per registry and the pricing page for plan details.

⚠

Free tier

Private scans require a paid plan. A signed-in free-tier user submitting a private scan gets 402 SUBSCRIPTION_REQUIRED.

Score interpretation

Every scan produces an AIVSS score (0–100) and letter grade:

GradeSafety scoreAIVSSMeaning
A81–100< 2.0Safe to use
B61–802.0–3.9Minor issues, review findings
C31–604.0–6.9Moderate risk, proceed with caution
D11–307.0–8.9High risk, significant issues found
F0–10≥ 9.0Critical risk, do not use

Grade is derived from the highest individual finding's AIVSS score, not an average — see Concepts: AIVSS for the full formula.

Next steps

  • Quickstart — run your first scan in 60 seconds
  • API Reference — integrate MCPSafe into your CI/CD pipeline
  • Concepts: AIVSS — understand how the score is calculated
  • Methodology — what we check, how we score, and what we don't do
NextQuickstart→