Build my server

Guides

MCP Security Tools: What Scanners, Inspectors and Gateways Check (Nov 2026)

By Team TrustedMCP

Add as preferred source on Google
On this page
MCP Security Tools: What Scanners, Inspectors and Gateways Check (Nov 2026)

No single MCP security tool checks everything. An MCP scanner reads what a server tells your agent. MCP Inspector lets you look yourself. Gateways contain servers while they run. Audit logs record what they did. Grade lookups check public signals like login, upkeep and CVEs. Pick one per layer.

We make one of these: a grade lookup, the TrustedMCP MCP server. It covers one layer and misses the rest, the same as every tool here. We checked each third-party tool's name, owner and features on 2026-11-12. This is not a ranking.

MCP security tools at a glance

Kind Examples Checks Misses
MCP scanners Snyk Agent Scan (was mcp-scan), Cisco MCP Scanner Tool descriptions, prompts and resources for injection, poisoning and risky capabilities Changes after the scan, upkeep, how you set it up
Inspector MCP Inspector Nothing on its own. It shows you the tools and lets you call them Anything you don't look at
Gateways Docker MCP Gateway Contains servers at run time: containers, secrets, network, call logs What a tool description says, servers you run outside it
Audit logs Client hooks, gateway logs, the service's own logs What was called, when, with what Nothing is blocked unless you add a rule
Grade lookups TrustedMCP (ours), Glama Public signals: login, upkeep, CVEs, connection, license Runtime behavior, ungraded servers

MCP scanners: what an MCP security scanner checks

An MCP scanner connects to each server in your config, reads its tool descriptions, prompts and resources, and flags text that tries to steer your agent. That's the prompt injection and tool poisoning problem: a tool description is instructions your model reads, and you usually never see it.

Snyk Agent Scan (formerly mcp-scan)

mcp-scan launched from Invariant Labs. Snyk acquired Invariant Labs in June 2025, and the tool is now Snyk Agent Scan at snyk/agent-scan (Apache-2.0, v0.6.11 released 2026-11-06). Run it with uvx snyk-agent-scan@latest, or download a signed binary.

  • What it finds: your installed agents, MCP servers and agent skills, across Claude, Cursor, GitHub Copilot, Windsurf, Gemini CLI and others. From v0.6 it reports prompt injection in tool descriptions, exposure to untrusted content, private data and destructive capabilities, plus skill risks like malicious code and suspicious downloads.
  • What it needs: a Snyk account and an API token (SNYK_TOKEN).
  • What it sends: component details to Snyk's Agent Scan API, including MCP server configs, tool names and descriptions, and skill content. Its README says secrets in config values are redacted first, and that it doesn't store your tool calls.
  • Watch out: to read tool descriptions, it has to start your stdio servers. It asks before each one in an interactive run. Snyk's own advice is to scan untrusted configs in a sandbox.

Cisco MCP Scanner

cisco-ai-defense/mcp-scanner (Apache-2.0, release 4.8.7 on 2026-10-20) is a Python CLI and REST server (cisco-ai-mcp-scanner on PyPI).

  • What it finds: malicious or risky tools, prompts, resources and server instructions, using three engines you can run alone or together: YARA rules, an LLM judge, and Cisco's AI Defense API. It can also scan a server's source code, check Python dependencies for known CVEs with pip-audit, look up bundled binaries on VirusTotal, and scan saved JSON offline.
  • What it needs: nothing for the YARA engine. The LLM judge needs your own LLM provider key, the AI Defense engine needs a Cisco key, and VirusTotal needs a VirusTotal key.
  • Try it: mcp-scanner --scan-known-configs --analyzers yara --format summary scans the configs on your machine with YARA only.

What MCP scanners miss

  • Anything that changes later. A scan reads what the server said today. A rug pull changes the descriptions after you approved them. Pin versions and scan again after updates.
  • Who maintains it. A clean scan says nothing about whether anyone will fix the next bug, or whether there are known CVEs in the package. (Cisco's pip-audit check covers Python dependencies.)
  • Your setup. An all-access token in env, a plain-HTTP remote or an unpinned npx line looks the same to a description scanner. Read the file: how to scan your MCP config.
  • Certainty. YARA rules catch known patterns. LLM judges catch more, but their answers vary from run to run. Treat a finding as "look here", and a clean result as "nothing obvious found".

MCP Inspector: look for yourself

MCP Inspector is the MCP project's own tool for testing servers. Version 2.15.0 (2026-11-12) runs as a web UI, a CLI or a terminal UI:

npx @modelcontextprotocol/inspector          # web UI
npx @modelcontextprotocol/inspector --cli    # scriptable

Connect it to a server and you can read every tool description, prompt and resource, and call a tool by hand to see exactly what comes back. That's the best way to answer "what does this server actually tell my agent?"

It gives no verdicts, though. It shows you everything and leaves the judging to you. And keep it current: two old CVEs hit the Inspector itself (CVE-2025-49596, no auth on its proxy, fixed in 0.14.1; CVE-2025-58444, command execution through XSS, fixed in 0.16.6). Step by step: how to run MCP Inspector.

Gateways: contain servers while they run

A gateway sits between your client and your servers. Every call goes through it, so it can isolate servers, hold secrets and log calls. More on the idea in what an MCP gateway is.

Docker MCP Gateway (docker/mcp-gateway, MIT) is the docker mcp CLI plugin behind the MCP Toolkit in Docker Desktop. Its security model says that by default:

  • each server runs in its own container with no-new-privileges and CPU and memory limits, and doesn't get your host environment variables;
  • secrets go only to the server that declares them;
  • --block-secrets scans tool arguments and responses for secret-like values;
  • --log-calls records tool names and the shape of the arguments, not their values;
  • images in Docker Hub's mcp/ namespace must have a valid signature;
  • HTTP transports need a bearer token.

What it misses: network egress isn't blocked unless a server asks for that or you run --block-network. Images outside mcp/ aren't signature-checked. It doesn't judge what a tool description says. And it only protects servers you run through it. Setup and our grade for it: Docker MCP Gateway and Toolkit.

Audit logs: what happened, after the fact

Logs don't stop anything, but they tell you what your agent did with each server.

  • In the client. Claude Code hooks can run a script before and after any tool call. MCP tools are named mcp__<server>__<tool>, so a matcher like mcp__.* catches all of them. A PreToolUse hook can also block a call.
  • In a gateway. Docker MCP Gateway's call log, above.
  • In the service. GitHub, Stripe, Google Workspace and most SaaS products keep their own audit logs. Calls an MCP server makes with your token show up there like any other API call.

Keep approval prompts on for tools that write, delete or send. A log tells you what went wrong; a prompt can stop it.

Grade lookups: check before you install

A grade lookup tells you about a server before you run it, from public signals. It doesn't start the server.

  • TrustedMCP (ours). A to D grades from four public signals: login, upkeep, known CVEs and how it connects. How we score servers. The check_config tool grades every server in your config, and registry_lookup reads official MCP Registry entries and reported issues. It doesn't read tool descriptions or watch calls.
  • Glama. A directory that calls itself a superset of the official MCP Registry: 119,892 servers on its home page on 2026-11-12, "all scanned and scored". It lists health checks, quality scores, security audits, tool schemas with annotations and license info per server, and it also runs its own inspector and gateway.
  • The official MCP Registry has no grades, but its namespaces are tied to a GitHub account or a domain the publisher proved they control. To look up its entries and reported issues, see how to check the MCP Registry.

What grade lookups miss: they're snapshots. Most servers in the registry have no grade at all, and a grade from public signals isn't an audit of the code.

How to combine them

A setup that covers most of the gaps, in the order you'd use it:

  1. Before you install: look up the grade, and read the config entry you're about to add (scan your MCP config).
  2. First run: start it in a sandbox. Read its tools in MCP Inspector, then run a scanner over it.
  3. Every day: run servers through a gateway, or at least with approval on for write and delete tools, and keep logs.
  4. After every update: check the version you pinned, then scan again.

The MCP security best practices and the OWASP MCP Top 10 list the risks each step covers.

Frequently asked questions

What is an MCP scanner, and what happened to mcp-scan?

An MCP scanner connects to the servers in your config and reads their tool descriptions, prompts and resources for text that tries to steer your agent. mcp-scan is now Snyk Agent Scan. Invariant Labs built mcp-scan, Snyk acquired Invariant Labs in June 2025, and the tool moved to snyk/agent-scan. You run it with uvx snyk-agent-scan@latest, and it needs a Snyk API token.

Is there a free MCP security scanner?

Cisco MCP Scanner is open source, and its YARA engine runs with no account or key. Snyk Agent Scan is open source too, but it needs a Snyk account and sends tool descriptions to Snyk's API. MCP Inspector is free, but it shows rather than scans.

Does MCP Inspector scan for vulnerabilities?

No. It connects to a server and shows you its tools, prompts and resources, and lets you call them by hand. You do the judging. Use a scanner for automated checks.

Do I need an MCP gateway?

Not for one or two servers you trust on your own laptop. A gateway helps when you run many servers, share a setup with a team, or run servers you don't fully trust and want them in containers with limited access.

Which MCP security tool is best?

None covers every layer, so the question is which layer you're missing. For tool descriptions, a scanner. For what the server does when you use it, Inspector and logs. For containment, a gateway. For "should I install this at all?", a grade lookup.

What does TrustedMCP check that scanners don't?

Upkeep, known CVEs and how the server handles login, from public sources, without running the server. It doesn't check tool descriptions, which is what scanners do. We built it, so weigh that.