RepoAI
Browse MCPs
Verified

Agent Scan MCP Server

Scan agent components, MCP servers, and skills for prompt injections and vulnerabilities.

Data last scanned today · Reviewed today

55★ 2,819PythonApache-2.0

Overview

Agent Scan identifies and audits installed agent infrastructure including harnesses, MCP servers, and individual skills. It performs threat detection by analyzing components for risks such as prompt injections, potential malware, and insecure handling of sensitive data within natural language prompts. To perform these assessments, the server initiates the specified MCP servers to inspect tool descriptions and configurations. Users can toggle specific features, such as excluding skills from the scan, to tailor the inspection process to their specific development environments.

Our verdict

This tool carries a high risk level with a security score of 50/100, primarily due to the fact that it must execute MCP server commands to perform its analysis. The repository is community-maintained and has not yet undergone an editorial review, which warrants caution. It is suitable for developers testing in sandboxed environments, but should not be used in production or on untrusted configurations without strict containment measures.

  • Supports scanning of MCP servers, agent harnesses, and skills
  • Zero direct dependencies minimize supply-chain surface area
  • Active development with commits within the last four days
  • Includes documentation on agent ecosystem threat analysis
  • Executes external MCP commands during the scanning process
  • CLI output format is currently experimental and subject to change
  • Not maintained by an official vendor
  • Missing a homepage link for extended documentation

Compatibility

ClientLocalDockerRemoteRead-only
Claude Desktop
Cursor
VS Code
Windsurf
ChatGPT

Frequently asked questions

›What prerequisites are required to run Agent Scan?

You must have a Snyk account, obtain an API token from your Snyk account settings, and set it as the SNYK_TOKEN environment variable before running the scan.

›Does Agent Scan execute code during analysis?

Yes, scanning MCP configurations requires executing the commands and arguments defined in them to retrieve tool descriptions. It is recommended to run these scans inside a sandbox or review the interactive consent prompts carefully.

›How can I prevent the scanner from analyzing agent skills?

You can use the --no-skills flag to ignore analysis on agent skills during your scan.

›Can I use this for automated production workflows?

No, the CLI output is considered experimental and subject to change. The developer explicitly recommends against building production workflows that depend on specific CLI output fields or issue codes.

›What installation methods are available?

You can run the tool as a Python package using uvx or download a standalone binary for your specific operating system and architecture from the GitHub Releases page.

›What should I do if I want to run scans without manual consent prompts?

You can use the --dangerously-run-mcp-servers flag to bypass manual consent, but this should only be used in trusted environments where you have verified all MCP server commands.

Alternatives

Jcodemunch MCP Server

cloud-infrastructure

582,225today

Fastapi MCP Server

cloud-infrastructure

5211,956today

AWS Labs MCP Server

cloud-infrastructure

769,504today

Grafana MCP Server

cloud-infrastructure

733,281today

Changelog

Badge

Agent Scan MCP Server security score, rated on RepoAI

Maintain this server? Add the live badge to your README.