MCP Watch 🔍
About
A comprehensive security scanner for Model Context Protocol (MCP) servers that detects vulnerabilities and security issues in your MCP implementations.
Details
- Author
- kapilduraphe
- Downloads
- 405
- Categories
- Other, Security
Jump to
- Credential Detection for hardcoded API keys and tokens
- Tool Poisoning detection for hidden malicious instructions
- Parameter Injection identification for sensitive data extraction
- Prompt Injection scanning for manipulation
Install globally with npm install -g mcp-watch or locally with npm install mcp-watch. To scan a GitHub repository, run mcp-watch scan <repository-url>. You can filter results by severity (--severity high) or category (--category credential-leak), and choose output format with --format json.
MCP Watch 🔍
A comprehensive security scanner for Model Context Protocol (MCP) servers that detects vulnerabilities and security issues in your MCP implementations.
Features
- 🔑 Credential Detection - Finds hardcoded API keys, tokens, and insecure credential storage
- 🧪 Tool Poisoning - Detects hidden malicious instructions in tool descriptions
- 🎯 Parameter Injection - Identifies magic parameters that extract sensitive AI context
- 💉 Prompt Injection - Scans for prompt manipulation and injection attacks
- 🔄 Tool Mutation - Detects dynamic tool changes and rug-pull risks
- 💬 Conversation Exfiltration - Finds triggers that steal conversation history
- 🎨 ANSI Injection - Detects steganographic attacks using escape sequences
- 📋 Protocol Violations - Identifies MCP protocol security violations
- 🛡️ Input Validation - Finds command injection, SSRF, and path traversal issues
- 🎭 Server Spoofing - Detects servers impersonating popular services
- 🌊 Toxic Flows - Identifies dangerous data flow patterns
- 🔐 Permission Issues - Finds excessive permissions and access control problems
Installation
Global Installation
npm install -g mcp-watch
Local Installation
npm install mcp-watch
From Source
git clone https://github.com/yourusername/mcp-watch.git
cd mcp-watch
npm install
npm run build
Usage
Command Line
```bash
Sign in to leave a review
Use Google, GitHub, or an email account so ratings stay tied to real people.
No reviews posted yet.
