Paste the Python for your Model Context Protocol server tools. Get instant findings across the six vulnerability classes that actually get MCP servers exploited. Your code is analyzed in your browser and never sent anywhere.
1. Path traversal — file tools joining user input without resolving+containing.
2. Command / code injection — shell=True, os.system, eval, exec.
3. Unsafe deserialization — pickle, yaml.load, torch.load, marshal, dill.
4. SSRF — fetch_url-style tools requesting attacker-controlled URLs.
5. Hardcoded secrets — API keys, tokens and passwords baked into source.
6. Missing input bounds — tool inputs read without size/type limits.
Heuristic static checks — they catch the common, high-severity patterns from real MCP audits. A clean scan is a good sign, not a proof; deep guards (symlink-safe path containment, SSRF resolver, safe-load shims) and regression tests are in the kit below.
This scanner flags the patterns. The MCP Server Security Hardening Kit gives you the copy-paste fixes that survive symlinks, argv injection and SSRF — plus the attacker payloads and pytest regression tests that keep each guard closed. From real audits, $19 one-time.
Get the kit — $19 See what's inside →