Summary
A security scanner that analyzes MCP servers and GitHub repositories for vulnerabilities using 59+ detection rules based on the OWASP MCP Top 10. You point it at an HTTP MCP endpoint or a repo URL, and it scans for tool poisoning, injection attacks, and other security issues. It returns findings with severity levels and exits with code 2 if it detects critical problems, making it straightforward to gate deployments in CI/CD pipelines. Requires a free API key from mcpshield.co. Reach for this when you're vetting third-party MCP servers before connecting them to Claude, or when you want automated security checks on your own servers before deployment.
Fastest browser for AI agents to run web automation tasks, always free.
Download Free life-time →
Notes, actions and memory. Without a meeting bot. First month 100% off.
Download for free →
belt cli automatically finds the best tools and skills for your agent. image, video, music, tts...
one prompt install →
Connect your Claude agent to live crypto prices and trading routes via 1inch
Get the MCP →
Block distracting apps from your iPhone permanently without a 3rd party app. Free and open source.
Block now (100% free) →MCPShield CLI
Scan MCP servers and GitHub repositories for security vulnerabilities.
Powered by MCPShield — the MCP security scanner with 59+ detection rules covering the OWASP MCP Top 10.
Install
npm install -g mcpshield
Setup
Get a free API key at mcpshield.co/settings, then:
mcpshield auth mcp_sk_your_key_here
Usage
# Scan an HTTP MCP server
mcpshield scan --url https://mcp-server.example.com/mcp
# Scan a GitHub repository
mcpshield scan --github https://github.com/user/repo
# JSON output (for CI/CD)
mcpshield scan --url https://mcp-server.example.com/mcp --json
# Filter by severity
mcpshield scan --url https://mcp-server.example.com/mcp --severity high
Exit Codes
0— Scan completed, no critical findings1— Error (invalid key, rate limit, scan failure)2— Scan completed with critical findings
Environment Variables
MCPSHIELD_API_KEY— API key (alternative tomcpshield auth)MCPSHIELD_API_URL— Custom API endpoint (for self-hosted)
License
MIT
Featured
Fastest browser for AI agents to run web automation tasks, always free.
Download Free life-time →Notes, actions and memory. Without a meeting bot. First month 100% off.
Download for free →belt cli automatically finds the best tools and skills for your agent. image, video, music, tts...
one prompt install →Connect your Claude agent to live crypto prices and trading routes via 1inch
Get the MCP →Block distracting apps from your iPhone permanently without a 3rd party app. Free and open source.
Block now (100% free) →Categories
Registryactive
Packagemcpshield-cli
TransportSTDIO
UpdatedApr 13, 2026
