mcp-tool-auditor is an open-source command-line tool designed for security researchers to scan and pentest MCP servers. Below are 39 security & compliance platforms apps with similar functionality to mcp-tool-auditor, matched by what each product actually does — not ranked or scored. Explore each to find the closest fit for your use case.
mcp-audits is an open-source CLI tool that scans, enumerates, and risk-scores permissions on locally configured MCP servers. It is designed for security engineers and AI infrastructure operators to ensure safe and compliant access control in AI systems.
mcp-config-audit is an open-source command-line tool that scans Model Context Protocol (MCP) configuration files for security issues. It operates locally, requiring no account or network connection, and outputs results in SARIF format. Designed for developers and security engineers who need to audit MCP configs securely and efficiently.
mcp-audit-scanner is an open-source CLI tool designed to audit Model Context Protocol (MCP) server configurations for security and privacy vulnerabilities. It assists security engineers in identifying and mitigating risks in AI agent infrastructure.
mcp-security-scan is an open-source CLI tool that scans MCP servers for hardcoded secrets, unsafe execution, and missing authentication. It helps developers and security engineers identify and remediate vulnerabilities in their MCP infrastructure.
mcp-mcts is an open-source CLI tool for local MCP security scanning, attack chain analysis, inventory management, and CI integration. It supports optional Semgrep and LLM analysis, making it suitable for security engineers and DevOps teams focused on codebase security.
mcp-strike is an open-source command-line tool designed for active, runtime adversarial testing of Model Context Protocol (MCP) servers. It helps security engineers and red teams identify vulnerabilities and weaknesses by simulating attacks and scanning for issues. The tool supports automated security assessments and is freely available under the MIT license.
mcp-checkup is an open-source CLI utility that audits MCP server setups, measuring context tax and hygiene. It helps AI infrastructure engineers and developers ensure their Model Context Protocol servers are efficient and healthy by providing detailed health checks and token analysis.
mcpscore is an open-source CLI tool that analyzes MCP servers for compliance, quality, and protocol validation. It generates comprehensive reports to help developers and administrators ensure their Model Context Protocol servers meet required standards.
Static analysis tool for MCP server Python code — detects security vulnerabilities via AST and taint tracking.
Security scanner for MCP (Model Context Protocol) servers - pentest your AI agent's tool connections
AI-powered security vulnerability scanner for MCP (Model Context Protocol) servers with automatic fixes, secret detection, and multi-channel alerts
mcpvet is an open-source CLI tool that combines testing, linting, and contract validation for MCP servers. It integrates with pytest and ESLint, streamlining the development and quality assurance process for developers working with the Model Context Protocol.
mcp-surfaceprint is an open-source CLI tool that allows users to inspect what an MCP server exposes before connecting to it. It helps security engineers and AI infrastructure teams audit and verify server configurations for safe integration with agent systems.
mcp-check-security is an open-source command-line tool that performs offline security checks on Model Context Protocol (MCP) server configurations. It helps developers and security engineers identify potential vulnerabilities and misconfigurations before deployment. The tool is designed for use in AI infrastructure environments.
mcp-toolguard is an open-source CLI tool for contract testing, drift detection, and security checks on MCP servers. It integrates with CI pipelines and production environments to help DevOps engineers maintain server integrity.
mcp-bandit is an open-source command-line tool for scanning Model Context Protocol (MCP) servers for security vulnerabilities, including prompt injection and SSRF. It is designed for security engineers to audit and analyze MCP deployments.
dfx-mcp-scanner is an open-source CLI tool for scanning Model Context Protocol (MCP) servers to detect malicious tools, data exfiltration, and supply chain risks. It is designed for security engineers managing AI agent infrastructure.
Linter for MCP (Model Context Protocol) config files used by Claude Desktop, Cursor, Cline, Windsurf, and Zed. CLI + library API.
mcp-risk-linter is an open-source CLI tool that analyzes MCP server tools for readiness and security risks, including authentication, filesystem, shell, and network vulnerabilities. It helps developers and DevOps teams ensure safer deployments.
ai-agentic-mcpscan is an open-source command-line tool that provides local-first, offline-by-default security posture scanning for Model Context Protocol (MCP) and local-agent environments. It is intended for security engineers and teams managing agent-based infrastructures.
tappy-mcp is an open-source command-line tool for discovering, configuring, running, inspecting, and monitoring Model Context Protocol (MCP) servers across AI clients. It provides infrastructure engineers and developers with essential tools to manage and monitor MCP-based AI deployments efficiently.
Test your MCP server like you test an API — declarative YAML, CI-ready, zero boilerplate.
mcp-builder-toolkit is an open-source CLI utility that generates Python MCP server projects based on manifest files. It streamlines the process of creating readable and tested server code, making it easier for developers to scaffold and maintain MCP-compliant services.
Reconnaissance and known-issue scanner for Model Context Protocol (MCP) servers
mcp-gui-tester is an open-source PyQt6 desktop application for developers to test and interact with MCP (Model Context Protocol) servers over HTTP. It provides a graphical interface to list tools, fill parameters, call tools, and inspect results, streamlining the development and debugging process for MCP integrations.
Simple MCP Client to quickly test and explore MCP servers from the command line
MCP Pre-Flight is a web-based submission auditing tool designed for developers preparing Model Context Protocol (MCP) servers for listing in the Claude and OpenAI directories. The platform addresses the challenge of ensuring that MCP server implementations meet directory requirements before undergoing formal review, aiming to catch common mismatches and issues that can lead to rejection. The tool performs a multi-layered audit process. At the wire level, it checks OAuth 2.1 with PKCE, dynamic client registration, authorization, token exchange, refresh flows, and MCP protocol endpoints such as initialize, tools/list, and tools/call. It also tests for resilience to malformed bodies and unknown methods. Each safe-to-invoke tool exposed by the MCP server is actually called with synthesized arguments to verify correct invocation. For tools that claim idempotency, the platform runs an idempotency probe by calling them twice and comparing the results. MCP Pre-Flight offers optional source-side analysis by accepting a GitHub repository URL. It uses the GitHub API to fetch the repository and runs an abstract syntax tree (AST) check, ensuring that handler implementations match their annotations. The tool also verifies that the README file mentions every tool declared in the source code. Additionally, it analyzes the language of responses for vocabulary that may contradict the tool's annotations. Each audit finding is tagged with the relevant directory—Claude or OpenAI—that the issue pertains to. The tool requires the HTTPS endpoint of a deployed MCP server, specifically one that responds to JSON-RPC tools/list. If OAuth is present, MCP Pre-Flight tests the full authentication flow. Authenticated checks can be unlocked by providing a test bearer token. For source analysis, public repositories can be used without authentication, while private repositories require a personal access token. MCP Pre-Flight is delivered as a free web tool. By simulating the directory review process and highlighting issues in advance, MCP Pre-Flight helps developers reduce the risk of delayed or rejected submissions when targeting the Claude and OpenAI directories.
mcpsnare is an open-source CLI tool that actively scans Model Context Protocol (MCP) servers for vulnerabilities using confirmation-driven techniques. It is designed for security professionals to automate security assessments and penetration testing of MCP endpoints.
mcpgawk is an open-source CLI tool for measuring and verifying MCP (Model Context Protocol) servers locally. It ensures no inventory data leaves the user's machine, providing security and transparency for AI infrastructure engineers and researchers. The tool is Apache-2.0 licensed.
mcp-agent-tester is an open-source tool for inspecting, testing, and running MCP servers and agents. It provides both a web UI and CLI, supports JSON trace export, and is designed for developers working with Model Context Protocol agents and infrastructure.
Fast, opinionated GCP security scanner. Curated checks. Zero noise. Copy-paste fixes.
Security scanner for MCP servers — detect prompt injection, credential leaks, exposed endpoints, and tool poisoning
guardmcp is an open-source CLI tool that scans MCP server configurations for security issues, including secrets, injection vulnerabilities, and authentication problems. It maps findings to the OWASP MCP Top 10, helping security engineers and DevOps teams secure their deployments.
boxadm-mcp is an open-source MCP server designed for Box admin-log analytics, offering external-sharing visibility and read-only access for security auditing. It helps enterprise IT administrators monitor and analyze Box usage and sharing activities for compliance and security.
hexis-mcp-guard is an open-source command-line tool that scans Model Context Protocol (MCP) servers for security vulnerabilities. It checks for issues such as misconfigurations and exposed secrets, helping administrators secure their MCP deployments. Designed for security engineers and server admins.
mcp-toolsmith is an open-source CLI utility for auditing and compiling Python tool schemas for use with LLM agents. It validates schemas against the Model Context Protocol, helping developers ensure compatibility and correctness before deployment.
MCPfinder is an open-source tool that helps AI agents discover and configure Model Context Protocol (MCP) servers. It inspects trust signals, manages environment variables, and generates install-ready configurations, streamlining integration for developers building AI agents that interact with external tools and data sources.
mcpfuzz is an open-source command-line tool for dynamically scanning Model Context Protocol (MCP) servers. It actively probes live servers with exploit payloads to identify vulnerabilities, supporting security researchers and penetration testers in automating MCP server assessments.
Kubernetes production-readiness auditor, exposed as an MCP server and CLI.
