mcpsnare is an open-source CLI tool that actively scans Model Context Protocol (MCP) servers for vulnerabilities using confirmation-driven techniques. Below are 24 security & compliance platforms apps with similar functionality to mcpsnare, matched by what each product actually does — not ranked or scored. Explore each to find the closest fit for your use case.
mcp-security-scan is an open-source CLI tool that scans MCP servers for hardcoded secrets, unsafe execution, and missing authentication. It helps developers and security engineers identify and remediate vulnerabilities in their MCP infrastructure.
mcp-mcts is an open-source CLI tool for local MCP security scanning, attack chain analysis, inventory management, and CI integration. It supports optional Semgrep and LLM analysis, making it suitable for security engineers and DevOps teams focused on codebase security.
MCPSafe is a security scanner designed specifically for Model Context Protocol (MCP) servers, offering pre-install audits to identify vulnerabilities and threats before deployment. The platform is aimed at developers who need to vet MCP servers prior to installation, as well as registry operators responsible for publishing secure catalogs. It provides both fast and deep scans, delivering a quick verdict in approximately three minutes and a more thorough consensus-based analysis in about twenty minutes. The tool combines static analysis with evaluations from five independent large language models (LLMs) to detect a wide range of issues. Its static analysis capabilities identify code-level vulnerabilities such as command injection, SQL injection, server-side request forgery (SSRF), path traversal, and hardcoded secrets. The LLM consensus approach uncovers more complex threats including tool poisoning, silent rug pulls, indirect prompt injection, and obfuscated intent that may evade traditional pattern matching. MCPSafe also performs typosquatting checks to flag lookalike package names, unverified publishers, and unpinned dependencies, helping to prevent supply chain attacks. A permission audit feature evaluates each tool’s real-world access, highlighting excessive permissions, weak authentication, and unintended network exposure. MCPSafe supports scanning a variety of sources, including GitHub repositories, npm and PyPI packages, Docker images, and MCP registry IDs. Users can specify a particular version for targeted analysis. The platform provides actionable score reports using the AIVSS (AI Vulnerability Scoring System), which extends traditional vulnerability scoring with factors relevant to agentic threats, and maps findings to CWE standards. Each scan generates a live SVG badge that can be embedded in documentation to display the current security grade. Results are kept up-to-date by fingerprinting the commit or version on every request, with rescans triggered automatically for new commits. The service is delivered as a web-based platform and is free to use, requiring no signup or credit card for public package scans. Signed-in users benefit from higher rate limits and access to scan history. MCPSafe is developed and operated from Germany.
orisan-mcpscan is an open-source CLI tool for scanning Model Context Protocol (MCP) servers for security vulnerabilities. It operates locally, providing fast and private assessments for developers and security professionals.
Security scanner for MCP (Model Context Protocol) servers - pentest your AI agent's tool connections
mcpscore is an open-source CLI tool that analyzes MCP servers for compliance, quality, and protocol validation. It generates comprehensive reports to help developers and administrators ensure their Model Context Protocol servers meet required standards.
nyuwaymcpscanner is an open-source CLI tool for enterprise security scanning of Model Context Protocol (MCP) servers. It provides static analysis, YARA rule integration, secrets detection, and supply chain security features, supporting AI and LLM security use cases.
mcp-check-security is an open-source command-line tool that performs offline security checks on Model Context Protocol (MCP) server configurations. It helps developers and security engineers identify potential vulnerabilities and misconfigurations before deployment. The tool is designed for use in AI infrastructure environments.
mcp-strike is an open-source command-line tool designed for active, runtime adversarial testing of Model Context Protocol (MCP) servers. It helps security engineers and red teams identify vulnerabilities and weaknesses by simulating attacks and scanning for issues. The tool supports automated security assessments and is freely available under the MIT license.
Reconnaissance and known-issue scanner for Model Context Protocol (MCP) servers
AI-powered security vulnerability scanner for MCP (Model Context Protocol) servers with automatic fixes, secret detection, and multi-channel alerts
ai-agentic-mcpscan is an open-source command-line tool that provides local-first, offline-by-default security posture scanning for Model Context Protocol (MCP) and local-agent environments. It is intended for security engineers and teams managing agent-based infrastructures.
Static analysis tool for MCP server Python code — detects security vulnerabilities via AST and taint tracking.
MCP (Model Context Protocol) server for pyscn Python code analyzer
mcp-bandit is an open-source command-line tool for scanning Model Context Protocol (MCP) servers for security vulnerabilities, including prompt injection and SSRF. It is designed for security engineers to audit and analyze MCP deployments.
mcp-fence is an open-source CLI tool for security scanning, protocol inspection, dynamic fuzzing, and sandboxed testing of Model Context Protocol (MCP) servers. It helps AI infrastructure engineers identify vulnerabilities and generate security reports.
mcp-tool-auditor is an open-source command-line tool designed for security researchers to scan and pentest MCP servers. It provides both defensive scanning and offensive pentesting capabilities, mapping to the OWASP MCP Top 10. The tool helps identify and mitigate security vulnerabilities in AI and LLM-related infrastructures.
hexis-mcp-guard is an open-source command-line tool that scans Model Context Protocol (MCP) servers for security vulnerabilities. It checks for issues such as misconfigurations and exposed secrets, helping administrators secure their MCP deployments. Designed for security engineers and server admins.
mcpfuzz is an open-source command-line tool for dynamically scanning Model Context Protocol (MCP) servers. It actively probes live servers with exploit payloads to identify vulnerabilities, supporting security researchers and penetration testers in automating MCP server assessments.
netmcp is an open-source CLI tool and MCP server for network analysis, integrating with Wireshark, Nmap, and threat intelligence sources. It is designed for network engineers and security professionals seeking advanced analysis tools.
mcp-audits is an open-source CLI tool that scans, enumerates, and risk-scores permissions on locally configured MCP servers. It is designed for security engineers and AI infrastructure operators to ensure safe and compliant access control in AI systems.
mcp-audit-scanner is an open-source CLI tool designed to audit Model Context Protocol (MCP) server configurations for security and privacy vulnerabilities. It assists security engineers in identifying and mitigating risks in AI agent infrastructure.
narsil-mcp is an open-source server and command-line tool designed to provide code intelligence specifically for AI agents. It addresses the challenge of enabling AI coding assistants to understand and navigate complex codebases by offering deep static analysis, security scanning, and semantic code search, all accessible through the Model Context Protocol (MCP). The tool is intended for integration with AI assistants that require advanced code understanding, such as symbol lookup, call graph analysis, and vulnerability detection. The platform supports 32 programming languages, including Rust, Python, TypeScript, Go, Java, C, Ruby, and Kotlin, among others. Its features include semantic search using BM25, TF-IDF, and neural embeddings to allow code to be found by meaning as well as text. Security scanning capabilities cover OWASP Top 10, CWE Top 25, secrets detection, and taint analysis. narsil-mcp also generates software bills of materials (SBOM), checks for OSV vulnerabilities, and assists with license compliance. Additional features include full call graph construction with transitive analysis, automated SBOM and CVE detection, type inference for Python, JavaScript, and TypeScript without external checkers, and Git integration for querying blame, history, hotspots, and contributors. The tool is delivered as a local MCP server and CLI application, with installation options available through package managers such as Homebrew, Cargo, npm, Scoop, and Nix. It operates entirely locally, ensuring that code does not leave the user's machine and no cloud connection is required. narsil-mcp outputs code intelligence in the Code Context Graph (CCG) format, an open standard for publishing machine-readable code intelligence that includes symbols, call graphs, and security findings in a single file. com. 0 and MIT licenses, reinforcing its open-source status. It is positioned as a comprehensive solution for AI assistants and developers seeking to enhance code understanding, security, and supply chain transparency within their software projects.
mcpvet is an open-source CLI tool that combines testing, linting, and contract validation for MCP servers. It integrates with pytest and ESLint, streamlining the development and quality assurance process for developers working with the Model Context Protocol.
