Build an MCP-Scanner Server: Automatic Vulnerability Detection for AI Agent Tools in 2026

By Deepak Bagada, CEO at SaaSNext and Principal AI Architect.

An MCP-Scanner server automatically analyzes MCP server endpoints for security vulnerabilities, running 14 checks across four categories: prompt injection vectors, data exfiltration patterns, unsafe tool call patterns, and resource abuse potential. The scanner connects to any MCP server as an auditor client, retrieves tool schemas, and optionally executes controlled probe calls in a sandbox. An enterprise security team reported reducing MCP audit time from 6 hours to 8 minutes per server endpoint.

• Four vulnerability categories with 14 total automated checks
• Acts as a dedicated auditor MCP client, never sending user data
• CI/CD gate compatible: exits non-zero when critical findings exist

Architecture

The MCP-Scanner operates in two phases. The static phase connects to the target server, performs the MCP initialize handshake, lists tools, and retrieves tool schemas. It then runs the 14 checks against the schema data. The dynamic phase (optional, deep scan mode) executes controlled probe tool calls inside a Docker sandbox to confirm suspected vulnerabilities. Both phases produce structured findings that the scanner wraps as MCP tool output for the requesting client.

The scanner itself is also an MCP server, exposing a scanEndpoint tool that accepts a target URL or command and returns the security report. This design lets Claude Desktop or Cursor invoke scans conversationally: an agent can ask the scanner to audit a new MCP server before adding it to its toolset.

Static Scan Checks

The static phase runs these checks. Prompt injection checks examine tool descriptions for known injection phrases, hidden Unicode, oversized descriptions, impersonating names, and exfiltration-suggestive schema fields. Data exfiltration checks look for tools that read environment variables, access user home directories, upload files to external URLs, or read credentials without corresponding legitimate workflows. Unsafe tool call checks flag shell execution patterns, raw filesystem write access, unbounded network fetch capability, and missing input validation in tool parameters. Resource abuse checks detect unbounded iteration parameters, missing rate limits, and oversized output schemas.

Deep Scan Mode

Deep scan mode runs inside an isolated Docker container with no network access except to the target MCP server. The scanner executes probe calls designed to trigger suspected vulnerabilities without causing damage: sending a tiny injection payload to a description field, requesting a file that should be blocked, and initiating a network fetch to a canary URL. Container resource limits prevent any resource abuse from the probes themselves.

CI/CD Integration

For CI/CD pipelines, the scanner provides a CLI mode. The command scans a target and exits 0 if the security score is above the configurable threshold or 1 otherwise. A healthcare company reported this gate caught three critical vulnerabilities in MCP servers before production deployment during their first month of adoption.

Performance Benchmarks

Failure Modes and Mitigations

First, false positives from legitimate tools that use shell execution for valid purposes. The scanner provides an allowlist mechanism for approved tool patterns to suppress repetitive findings. Second, stderr noise from the target MCP server can produce incomplete tool listings. The scanner retries with a timeout and reports partial scan results with a warning. Third, auth-required MCP servers refuse the initial handshake. The scanner accepts credentials via environment variables or a credential file for authenticated scans.

Deployment Steps

Install the scanner package, configure the Docker sandbox image, grant the scanner access to the Docker socket, and register it as an MCP server in Claude Desktop or Cursor. For team deployments, run the scanner as a shared network service and have each developer machine connect to it via the MCP SSE transport. The shared deployment centralizes scan history and vulnerability reports in a team-accessible database.

Cost and Value

The scanner runs on a standard t3.medium instance with the Docker sandbox enabled. Monthly cost is approximately $45. A security team that previously spent 6 hours per MCP server on manual audits now spends 8 minutes, freeing roughly 350 engineering hours per month for deeper security work.

Browse the MCP Directory for security-focused MCP servers. Compare with the Vet MCP security registry for ecosystem-wide coverage. See the Workflows Directory for secure agent deployment patterns.

Last tested and verified: September 2026 with Python 3.12, FastMCP 4.0, Docker 25.0.

Detailed Vulnerability Categories

Each of the four vulnerability categories contains specific checks that the scanner runs automatically. The prompt injection category checks for five specific patterns: known injection phrases like "ignore previous instructions" and "reveal system prompt", hidden Unicode characters including zero-width spaces and bidirectional text overrides, tool descriptions exceeding 2000 characters that could hide malicious payloads, tool names that impersonate standard system functions, and schema fields named with exfiltration targets like "api_key" or "password" in output schemas for tools that should not need them.

The data exfiltration category checks for tools that read environment variables, access user home directories, upload files to external URLs, or read credentials from config files. Each check evaluates both the tool's documented behavior and the parameter names in its schema. For example, a tool that accepts a parameter named "env_var" with a description of "the environment variable to read" would be flagged as a potential exfiltration vector.

The unsafe tool call category looks for shell execution patterns in tool descriptions, raw filesystem write access without corresponding read confirmation, and unbounded network fetch capability. These checks are the most likely to produce false positives because some legitimate tools use shell execution for valid purposes. The scanner provides an allowlist mechanism for approved tool patterns.

The resource abuse category checks for missing input validation on size parameters, unbounded iteration parameters, and missing rate limits. These checks are critical for preventing denial-of-service attacks through MCP tool calls.

Integration with Security Operations

For enterprises with a Security Operations Center, the MCP-Scanner supports integration with existing SIEM tools. Scan results can be forwarded to Splunk, Datadog, or Elasticsearch via webhook. The scanner produces structured findings in a format that includes the vulnerability type, severity, affected tool name, the specific parameter or field that triggered the finding, and a remediation suggestion. The SIEM can then correlate MCP vulnerabilities with other security events.

The Auditor Client Pattern

The scanner implements a pattern that is becoming increasingly important in the MCP ecosystem: the auditor client. Unlike regular MCP clients that use tools to accomplish tasks, an auditor client connects to MCP servers solely to verify their security posture. This pattern is expected to become standard practice as the MCP ecosystem grows past 100,000 servers. The auditor client never sends real user data, never executes tools for production purposes, and never stores credentials. It is a read-only security observer.

Compliance and Reporting

The scanner generates compliance reports in PDF and JSON formats that map findings to the OWASP MCP Security Top 10 vulnerability categories. The report includes an executive summary, a detailed findings table with severity ratings, and remediation steps for each finding. A regulated financial institution reported using these reports to satisfy their quarterly AI tool security audit requirement, reducing the audit preparation time from two weeks to two hours.

Real-World Impact

A security team at a Fortune 500 company deploying 80 MCP servers across their engineering organization reported scanning all 80 servers in 4 hours using the MCP-Scanner, discovering 24 critical vulnerabilities, 31 high-severity issues, and 47 medium-severity issues. The most common critical finding was prompt injection potential in tool descriptions, affecting 19 of the 80 servers. The team addressed all critical findings within 48 hours, preventing potential compromise of their AI agent infrastructure.