MCPGuard: MCP server poisoning scanner

Scan MCP tools for prompt injection, leaked keys and overreach before you install them

Problem

The MCP ecosystem is exploding, and more servers are published by solo devs or unknown third parties. Tool descriptions can hide prompt injection, hardcoded secrets or over-privileged access. When developers plug a third-party MCP into Claude Desktop or their own agent, there is almost nothing that warns them the tool description could trick the model into leaking data. Existing projects only do directory scanning with limited coverage.

Solution

A CLI and GitHub Action that parses an MCP server's tools descriptions and input schemas, then uses a rule library plus a local small model to detect prompt injection patterns, sensitive field exfiltration, suspicious URLs and hardcoded tokens. It outputs a risk report with fix suggestions and supports CI diff alerts on MCP changes.

Users

Indie developers integrating third-party MCPs, AI engineers, MCP server authors, enterprise AI security leads

MVP

Parse MCP server tools/list output; ship 30 built-in prompt-injection and secret-leak rules; CLI outputs JSON/HTML risk report; provide a GitHub Action template; maintain a public MCP poisoning sample library

Revenue

Open-source CLI plus paid SaaS dashboard for team rule management, scan history and compliance reports, priced per repo; enterprise tier with private rules and SARIF export

Why now

MCP is becoming the de facto standard for AI tool integration and server count is growing fast, yet security review is missing. Big vendors have not covered this narrow static-analysis layer, making it a good fit for a solo dev starting with a rule library.