Agent Security Scanner Mcp
by sinewaveaicommunityv2.0.1
117
11
This MCP server scans code, git diffs, projects, MCP servers, and agent prompts/actions for security issues such as vulnerabilities, prompt injection, hallucinated packages, and supply-chain risks. It also supports SBOM generation/vulnerability checks and compliance evidence collection for frameworks like SOC2 and GDPR.
From the registry: Security layer for AI agents: blocks prompt injection, detects fake packages, scans vulnerabilities.
Install & configure
Prerequisites
- requiredPyYAMLRequired for rule loading
$ pip install pyyaml - optionaltree-sitter (optional)Enhanced AST detection
$ pip install tree-sitter tree-sitter-python tree-sitter-javascript
Install in your client
Paste into the AI you're chatting with — it will figure out the rest
Please install the `agent-security-scanner-mcp` MCP server into my current AI client (that's you).
Required prerequisites (do these first if not already done):
- **PyYAML** — Required for rule loading Run: `pip install pyyaml`
Optional prerequisites:
- tree-sitter (optional) — Enhanced AST detection Run: `pip install tree-sitter tree-sitter-python tree-sitter-javascript`
Canonical MCP server config (stdio transport):
- command: `npx`
- args: ["-y","agent-security-scanner-mcp"]
Note: Also provides `npx agent-security-scanner-mcp init <client>` to auto-configure config files.
Add this MCP server to my current client's config in the correct format for you. If you need secrets or credentials I haven't provided, ASK me — do not invent values or leave raw placeholders. After adding it, tell me how to verify the server is connected.Note: Also provides `npx agent-security-scanner-mcp init <client>` to auto-configure config files.
Tools (19)
scan_security
Scan code for vulnerabilities with AST and taint analysis.
fix_security
Automatically fix detected security issues.
scan_git_diff
Scan only changed files in a git diff.
scan_project
Scan an entire project and produce an A-F security grade.
check_package
Verify that a package name is real and not hallucinated.
scan_packages
Bulk-check imports in a file for hallucinated packages.
scan_agent_prompt
Detect prompt injection in external or untrusted input.
scan_agent_action
Check whether an agent-generated action should be allowed, warned, or blocked.
scan_mcp_server
Scan MCP server source for vulnerabilities and supply-chain risks.
scan_skill
Deep-scan an OpenClaw skill for security threats and supply-chain issues.
scanner_health
Check plugin and engine health/status.
list_security_rules
List available security rules and fix templates.
sbom_generate
Generate a CycloneDX SBOM for a project.
Environment variables
ANTHROPIC_API_KEYrequiredAPI key required when using the Anthropic provider for the LLM-powered code review agent.OPENAI_API_KEYrequiredAPI key required when using the OpenAI provider for the LLM-powered code review agent.Prerequisites
- • Node.js >= 18.0
- • Python 3.x
- • Node 22
Packages
agent-security-scanner-mcp
npmv2.0.1transport: stdio
Details
- Language
- JavaScript
- License
- MIT
- Released
- Feb 6, 2026
- Last commit
- Jul 12, 2026
- Registry name
- io.github.sinewaveai/agent-security-scanner-mcp