Discover shadow MCP
Inventory configured MCP servers across supported clients and projects, including local and remote targets that may not be centrally tracked.
Open-source MCP security · Source beta
Secure the layer between AI agents and real-world tools.
MCPShield scans Model Context Protocol deployments for dangerous configurations, vulnerable packages and poisoned tools—then adds runtime policy enforcement, tamper-evident auditing and agent observability.
60security rules
10MCP clients covered
3runtime transports
0API keys for static scans
mcpshield scan --auto
v1.1.1rc1
$ mcpshield scan --auto
MCPShield source beta · local security assessment
CRITICALKnown malicious MCP packageMCPS-SUP-003
HIGHTool description contains hidden instructionsMCPS-TOOL-001
HIGHPrivate-network destination in tool argumentsRUNTIME
MEDIUMPackage version is not pinnedSUPPLY CHAIN
Risk99/100
GradeF
Servers7
✓ Static scan complete. No cloud service required.
Why MCPShield
MCP expands the blast radius of an AI agent. Security has to move with it.
Every MCP server can add code, capabilities and model-visible instructions to an agent session. MCPShield gives engineering and security teams a practical way to discover that surface, assess it, lock reviewed definitions and enforce policy at runtime.
Assess trust before execution
Check configs, launchers, packages, permissions, secrets, remote endpoints and tool metadata before an agent depends on them.
Control runtime behavior
Put a policy guard between client and server to block risky calls, redact secrets, deny sampling and preserve an auditable record.
One toolkit · Multiple layers
From configuration review to runtime enforcement.
STATIC
Config & supply-chain audit
Detect secrets, unsafe shell/download-and-execute patterns, excessive filesystem scope, insecure remotes and vulnerable, malicious or unpinned packages.
- 10 MCP client formats
- JSONC & TOML aware
- Shadow-MCP inventory
LIVE
Tool & server inspection
Inspect live server metadata without calling tools. Analyze descriptions and schemas for poisoning, Unicode hiding, shadowing and exfiltration-oriented parameters.
- stdio, Streamable HTTP & SSE
- MCP 2026-07-28 + legacy fallback
- Remote security probes
PIN
Rug-pull detection
Record reviewed tool definitions and detect later changes before a protected tool call is allowed.
- Lock-backed definition verification
- List-change invalidation
- Fail-closed verification
RUNTIME
Policy guard & DLP
Wrap stdio MCP servers with policy enforcement for tools, arguments, sensitive paths, private networks, sampling and result handling.
- Monitor & enforce modes
- Secret redaction
- Bounded request handling
OBSERVE
Agent activity traces
Trace MCP sessions and tool calls with OpenTelemetry-compatible spans and security context without requiring a hosted telemetry service.
- W3C trace context
- Lethal-trifecta session alerts
- Local trace browser
SHIP
Security outputs for teams
Move findings into the workflows teams already use: console, JSON, SARIF, Markdown, HTML and CI fail thresholds.
- GitHub code scanning
- Pre-commit support
- Baselines & allowlists
How it works
Start safe. Add depth only when you need it.
MCPShield is designed around a progressive workflow. Static discovery and configuration assessment come first. Live inspection and runtime controls are explicit steps—not hidden side effects.
1
Discover
Find MCP configurations and build an inventory.
2
Assess
Score config, package, endpoint and tool risks.
3
Pin
Lock reviewed tool definitions to detect changes.
4
Guard & observe
Enforce policy and trace real agent activity.
Runtime architecturedefense in depth
CLIENTAI AgentClaude · Cursor · VS Code · Codex
JSON-RPC→
NULLVORAMCPShield GuardPolicy · DLP · Pin verification · Audit
validated→
SERVERMCP ToolsFiles · APIs · DB · Browser · Shell
Monitor mode can observe without mutating proxied output. Enforce mode adds configured controls.
Built for real security workflows
Use MCPShield locally, in CI, or around the runtime.
Keep static analysis local, export SARIF into code scanning, send traces to your own OTLP backend, or wrap selected stdio servers with policy enforcement. You choose the operating model.
Local-firstNo API key required for static scans.
CI-readyGitHub Action, pre-commit and fail thresholds.
Vendor-neutralOTLP export to the backend you already use.
Open sourceApache-2.0 licensed and publicly reviewable.
Public source beta · v1.1.1rc1
Run your first MCP security scan in minutes.
Install the current release candidate directly from the public repository. Package and container registry publishing remain intentionally disabled while we collect external feedback.
✓ Python 3.10+
✓ No API key for static scans
✓ Linux · macOS · Windows
Quick start
git clone https://github.com/Nullvora/MCPShield.git
cd MCPShield
python -m venv .venv
source .venv/bin/activate
python -m pip install .
mcpshield --version
mcpshield scan --autoWindows PowerShell:
.venv\\Scripts\\Activate.ps1
Trust through clarity
Strong controls without false certainty.
MCPShield is security tooling, not a magic boundary. The project documents what it can detect, where it can enforce policy and where platform isolation is still required.
Fail-closed hardening
Malformed protocol messages, invalid policy and incomplete pin verification are treated as security conditions rather than silently accepted.
Privacy-aware by default
Argument capture for audit and OTLP is opt-in, audit keys are isolated from child processes and static scans do not require a hosted service.
Known limitations are public
The runtime guard is defense in depth—not an OS sandbox. Hostile servers still belong behind container, process and network controls.
SOURCE BETA
We want adversarial feedback.
Try MCPShield on real MCP configurations. Report installation friction, false positives, false negatives, missing attack patterns and whether the findings changed how you trust or configure a server.
Documentation
Read the design, rules and release boundaries.
Nullvora · Securing agentic AI
Explore MCPShield on GitHub