About MCP Shield
MCP Shield is an open-source scanner for developers checking MCP server code and projects for security issues. It applies 20 rules, reports findings with CWE references and remediation guidance, and assigns an A–F grade.
Key features
- 0120 security rules
- 02SSRF and path traversal checks
- 03Injection and authentication checks
- 04CWE-linked findings
- 05Remediation guidance
- 06A–F security grading
Use cases
- 01Scan an MCP server source file
- 02Review a project for security risks
- 03Inspect findings and remediation steps
MCP support
MCP Shield provides MCP tools for scanning files, directories, and code. It can also run as a CLI.
Configuration
Local server config is the same for every client. Copy it into your client’s MCP config file.
Tools
Local servers expose tools only once running on your machine, and the maintainer has not provided a tool list.
Details
From the project READMEMCP Shield
Open-source security scanner for MCP servers. 20 rules across 6 categories. Scan any server in seconds. Get a grade from A to F.
36.7% of MCP servers are SSRF-vulnerable (BlueRock, 2026). 82% have path traversal flaws. Only 17% are production-ready. MCP Shield finds the vulnerabilities before attackers do.
Quick Start
git clone https://github.com/sophiacave/mcp-shield
cd mcp-shield
# Scan a file
python3 src/cli.py scan path/to/mcp_server.py
# Scan a project
python3 src/cli.py scan path/to/mcp-project/
What It Checks (20 Rules)
| Rule | Severity | What It Detects |
|---|---|---|
| SSRF-01 | Critical | User input in HTTP request URLs |
| SSRF-02 | Medium | Dynamic URLs without validation |
| SSRF-03 | Medium | DNS rebinding (URL validated but no IP pinning) |
| PATH-01 | High | User input in file paths |
| PATH-02 | Medium | No path traversal protection |
| PATH-03 | Medium | Symlink following without check |
| INJ-01 | Critical | eval/exec on user input |
| INJ-02 | Critical | SQL string interpolation |
| INJ-03 | High | subprocess with shell=True |
| INJ-04 | High | Template injection via .format() |
| INJ-05 | Critical | Unsafe deserialization (pickle/yaml) |
| AUTH-01 | Medium | No auth on tool handlers |
| AUTH-02 | Critical | Hardcoded secrets/API keys (OpenAI, Stripe, GitHub, AWS) |
| AUTH-03 | Low | No rate limiting on tool endpoints |
| SEC-01 | High | SSL verification disabled |
| SEC-02 | Medium | Wildcard CORS |
| SEC-03 | Medium | Stack traces/error details exposed to client |
| SEC-04 | Low | No input length validation (DoS risk) |
| LOG-01 | Low | No logging/audit trail on tool invocations |
Testing
python3 tests/test_integration.py
# 28 tests, 0 failures
MCP Server Integration
Add to ~/.claude/mcp.json:
{
"mcpServers": {
"mcp-shield": {
"command": "python3",
"args": ["/path/to/mcp-shield/src/mcp_server.py"]
}
}
}
Claude Code tools: shield_scan_file, shield_scan_directory, shield_scan_code
Example Output
MCP Shield: my-server/ — 3 finding(s)
[CRIT] SSRF-01: Potential SSRF: Dynamic URL from user input
requests call with dynamic URL that may include user input
Location: server.py:45
Fix: Validate URL against allowlist. Block internal IPs.
CWE: CWE-918
[HIGH] INJ-03: Command injection: subprocess with shell=True
subprocess called with shell=True. User input in args = RCE.
Location: tools.py:112
Fix: Use subprocess with shell=False and pass args as list.
CWE: CWE-78
[MED] AUTH-01: No authentication detected on tool handlers
MCP tool handlers found but no auth logic detected
Fix: Add authentication middleware.
CWE: CWE-306
Grade: F | 1 critical, 1 high, 1 medium
Features
- Zero dependencies — Pure Python, no pip installs required
- 20 security rules across SSRF, path traversal, injection, auth, config, and logging
- CWE references — Every finding maps to a Common Weakness Enumeration ID
- Actionable fixes — Each finding includes specific remediation steps
- A-F grading — Instant security posture assessment
- Dual mode — Run as CLI or as an MCP server inside Claude Code
- Fast — Scans a typical MCP server in under 1 second
Why This Exists
The MCP ecosystem has 9,400+ servers and 97M monthly SDK downloads. Security tooling hasn't kept up. We built MCP Shield because every MCP server deployed without a security scan is a liability.
Built by Like One, a 501(c)(3) nonprofit. Security tooling should be free.
License
MIT — Like One
Comments
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.