mcpField
M
mcpshield

mcpshield

Local
github.com/MCPShield-DevSecurity0Updated 29w ago
Repository

About mcpshield

mcpshield is a CLI for scanning MCP servers and GitHub repositories for security vulnerabilities. It reports findings in human-readable or JSON output for use in CI/CD.

Key features

  1. 01Scan HTTP MCP servers
  2. 02Scan GitHub repositories
  3. 03Emit JSON scan results
  4. 04Return critical-finding exit codes

Use cases

  1. 01Check an MCP server before deployment
  2. 02Add repository scans to CI/CD

MCP support

Scans MCP servers for security vulnerabilities, including tool poisoning and injection, using detection rules covering the OWASP MCP Top 10.

Configuration

Local server config is the same for every client. Copy it into your client’s MCP config file.

mcp.json · Universal config
{
  "mcpServers": {
    "mcpshield-dev-mcpshield": {
      "command": "npx",
      "args": [
        "-y",
        "mcpshield-cli"
      ]
    }
  }
}
Run commandnpx -y mcpshield-cli

Local servers need a runtime on your machine (e.g. Node.js 18+). Config file locations differ by client; see your client’s docs.

Packages
npmmcpshield-cli2.0.2

Tools

No tool list yet

Local servers expose tools only once running on your machine, and the maintainer has not provided a tool list.

Details

From the project README

MCPShield CLI

Scan MCP servers and GitHub repositories for security vulnerabilities.

Powered by MCPShield — the MCP security scanner with 59+ detection rules covering the OWASP MCP Top 10.

Install

npm install -g mcpshield

Setup

Get a free API key at mcpshield.co/settings, then:

mcpshield auth mcp_sk_your_key_here

Usage

# Scan an HTTP MCP server
mcpshield scan --url https://mcp-server.example.com/mcp

# Scan a GitHub repository
mcpshield scan --github https://github.com/user/repo

# JSON output (for CI/CD)
mcpshield scan --url https://mcp-server.example.com/mcp --json

# Filter by severity
mcpshield scan --url https://mcp-server.example.com/mcp --severity high

Exit Codes

  • 0 — Scan completed, no critical findings
  • 1 — Error (invalid key, rate limit, scan failure)
  • 2 — Scan completed with critical findings

Environment Variables

  • MCPSHIELD_API_KEY — API key (alternative to mcpshield auth)
  • MCPSHIELD_API_URL — Custom API endpoint (for self-hosted)

License

MIT

Comments

Markdown supported

New to MCP?

From what the protocol is to installing your first server, these answers cover most first questions.

An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.