Skip to content

Back to the catalog

mcpwn
github.comrepo

mcpwn

mcpwn is a CLI security scanner for Model Context Protocol (MCP) servers, described as "nikto or nuclei, but for MCP servers." It runs checks (MCP-001 through MCP-013+) that statically analyze tool descriptions/schemas for hidden-instruction tool poisoning and, in an --aggressive mode, actively probe for prompt injection via tool output, SSRF against internal IPs/cloud metadata endpoints, command injection via shell metacharacters, cross-tool data exfiltration via canary tokens, and hardcoded secrets in resources. It supports stdio/SSE/HTTP transports, JSON/SARIF output for CI gating, and pairs with a companion runtime tool called mcp-firewall.

TL;DR Open-source MCP server vulnerability scanner (nuclei-style) that detects tool poisoning, prompt injection, SSRF, command injection, and secrets exposure in Model Context Protocol servers.
Open original ↗
Document

What it is

mcpwn (v0.2.0, pip install mcpwn) is a CLI security scanner for MCP servers. Beyond the six numbered checks in the summary, the page reveals additional checks not previously listed: MCP-012 (resource content reads, benign in safe mode) and MCP-013 (command injection via shell-metacharacter payloads).

How it works

It connects over stdio, SSE, or Streamable HTTP; enumerates tools, resources, and prompts; analyzes descriptions/schemas; and optionally probes with crafted inputs. MCP-001 tool-poisoning detection specifically looks for invisible Unicode characters, markdown/HTML comments carrying directives, social-engineering phrases ("ignore previous", "system override"), and base64-encoded payloads in tool descriptions.

Safe vs. aggressive — the important boundary

The summary names both modes but not their exact behavior. In safe mode it only reads schemas/descriptions and calls tools with benign inputs; it explicitly never probes internal IPs, sends injection payloads, or plants canaries. --aggressive adds live SSRF probes against http://127.0.0.1/, the cloud metadata endpoint, and file:///etc/passwd, sends shell-metacharacter payloads (MCP-013), tests input reflection (MCP-002), and plants canary tokens for cross-tool data flow (MCP-003).

The page states: only run aggressive scans against servers you own or are authorized to test.

What to do

Two commands not in the summary are worth knowing:

# Scan every MCP server configured in Claude Desktop, in one shot
mcpwn scan --claude-config

# Two-step CI gate
mcpwn scan --stdio "python server.py" --format json --output results.json
mcpwn check --input results.json --fail-on high   # exits 1 on failure

Config lives in auto-loaded mcpwn.yaml, supporting per-check tuning the summary omits — severity_threshold, custom_patterns for MCP-001, internal_ranges for MCP-004, and callback_host for the MCP-003 exfiltration listener. Precedence: CLI flags > config file > built-in defaults.

Caveats

Aggressive mode actively fetches internal/metadata/file:// URLs and injects payloads against the target — it is an attack, not just analysis, hence the authorization requirement. The page shows check descriptions truncating (MCP-004 static-analysis detail is cut off), so the full check catalog beyond what is listed here is not fully documented on this page.

Technologies named here

Techniques named here

  • MCP-001 Tool Poisoning
  • MCP-002 Prompt Injection
  • MCP-003 Data flow analysis / exfiltration detection
  • MCP-004 SSRF probe testing
  • MCP-005 Excessive Permissions / Permission enumeration
  • MCP-006 Missing Input Validation
  • MCP-012 Secrets exposure scan
  • MCP-013 Command injection detection

Related in AI Security