Which MCP security scanner should I use?

It depends on what you are protecting. If you are shipping an MCP server package, MCPSafe and Cisco MCP Scanner check the source for code-level vulnerabilities and behavioral threats before it reaches users. If you want to audit MCP configs on a developer machine, Snyk agent-scan auto-discovers Claude/Cursor/Windsurf configs and checks them for 15+ risk categories. If you are running a self-hosted server and need to know whether the whole box — host, containers, exposure, and AI agents together — is fit to ship, Keelix is the only tool that folds all of that into a single posture score. Most teams running AI workloads on self-hosted infrastructure will want at least two of these.

Do any of these scanners require an API key?

Snyk agent-scan requires a SNYK_TOKEN (a free Snyk account provides one). Cisco MCP Scanner works without any credentials for its YARA and readiness checks; the LLM-judge and Cisco AI Defense analyzers are optional and require their own keys. Keelix, AgentGrade, and MCPSafe run without credentials for their core functionality.

Does scanning MCP servers in CI actually block attacks?

Supply-chain scanning (MCPSafe, Cisco MCP Scanner) catches poisoned or malicious MCP server packages before they reach your environment. Config-level scanning (Snyk agent-scan, Keelix) catches risky configurations that were provisioned at deploy time — auto-approval, plaintext secrets, unvetted servers. Both layers matter, but they address different attack surfaces. A scanner that only looks at the code misses the configuration risk; a scanner that only looks at configuration misses the supply-chain risk.

What is the difference between Keelix and Snyk agent-scan?

Snyk agent-scan is a developer-time tool: it reads the MCP server configs on your current machine and flags risky entries — tool poisoning patterns, hardcoded secrets, over-permissive configs. It requires a Snyk API token and reports findings per server. Keelix is a deploy-time tool: it scans the running box — host config, open ports, container posture, and MCP configs together — and produces a single 0–100 score you can gate CI on. They are complementary: Snyk catches MCP-level issues early; Keelix confirms the whole deployment is safe.

Is AgentGrade an MCP security scanner?

AgentGrade grades the HTTP surface of a published MCP server endpoint — HTTPS, authentication headers, CORS policy, credential exposure in responses. It is useful for checking whether a deployed server is accessible securely. It does not scan source code, scan local configs, or assess the host environment. Think of it as a TLS/auth hygiene checker for the server's public endpoint rather than a deep security scanner.

MCP Security

Best MCP security scanners (2026)

The MCP security tooling landscape is young and fragmented. Five tools have emerged in the past twelve months — each scanning a different surface. This roundup covers what each tool actually checks, what it misses, and when you need more than one.

Why MCP security requires more than one scanner

MCP security risk lives at three distinct layers — and no single tool covers all three.

Supply chain: Is the MCP server package itself malicious, typosquatted, or carrying hardcoded secrets in its source? Caught by MCPSafe and Cisco MCP Scanner before the package lands on a machine.
Configuration: Is the MCP server configured unsafely on this machine — auto-approving all tool calls, storing an API key in plaintext, connecting to an unvetted server? Caught by Snyk agent-scan and Keelix at the config layer.
Deployment context: Even if the package is clean and the config looks fine, is the host running it hardened? Are the right ports actually closed from the internet? Do the AI/MCP risks roll up to a number you can gate a deploy on? Only Keelix addresses this layer.

The tools in this roundup are honest about their scope. Running one does not substitute for the others.

The tools

1. Keelix — whole-box posture gate

Keelix is the only scanner in this roundup that grades the deployment context — not just the MCP server in isolation. It runs on the box, discovers every MCP server config (Claude Code, Cursor, Windsurf, and others), checks for auto-approval, plaintext secrets, unvetted publishers, and the lethal trifecta, then folds those findings into the same 0–100 posture score that already covers host config, open ports, and container misconfigurations.

The result is a single number you can gate a CI deploy on: “Did the whole box — including the AI agents on it — pass a threshold before we promote to production?” No other scanner in this list answers that question. Apache-2.0 CLI, free, nothing leaves the box.

Where Keelix is weaker: it does not perform deep supply-chain analysis of MCP server source code (MCPSafe and Cisco do that better), and it does not scan MCP packages on PyPI or npm before they are installed.

2. Snyk agent-scan — developer-machine config scanner

Snyk agent-scan (formerly mcp-scan by Invariant Labs, now maintained by Snyk) auto-discovers MCP server configs on the current machine — Claude, Cursor, Windsurf, Gemini CLI, Amazon Q, and others — and checks them for 15+ risk categories: prompt injection patterns, tool poisoning, tool shadowing, toxic flows, credential handling, and hardcoded secrets. Apache-2.0, runs on macOS/Linux/Windows.

The main friction: a Snyk API token (SNYK_TOKEN) is required. A free Snyk account provides one, but the account-gating is a meaningful barrier for air-gapped or policy-constrained environments. The scanner also operates at the config layer: it does not grade the host, the network exposure, or the deployment context around those configs.

3. Cisco MCP Scanner — supply-chain + source analysis

Cisco's mcp-scanner (Apache-2.0) analyzes an MCP server's source code — not its live config — using three independent engines: YARA rules for pattern matching, an optional LLM-as-judge for semantic analysis, and the Cisco AI Defense API for threat detection. It also scans Python dependencies for CVEs (via pip-audit), verifies that tool implementations match their descriptions, and checks server instructions for prompt injection.

The YARA and readiness checks run without any API credentials, making it genuinely useful in a pipeline with no external dependencies. The LLM-judge and Cisco AI Defense analyzers require keys but add the strongest semantic analysis in the category. Best used at package-review time, not as a whole-box deploy gate.

4. AgentGrade — HTTP-surface endpoint checker

AgentGrade grades a live MCP server endpoint on 14 HTTP-surface criteria: HTTPS, authentication headers, CORS policy, credential exposure, and security headers. It assigns an A–F letter grade and provides per-check remediation guidance. Free, web-based, no local install.

The scope is narrowly HTTP-surface: AgentGrade does not look at source code, MCP tool descriptions, prompt injection patterns, or the host environment. Think of it as a TLS/auth hygiene check for a published server endpoint — valuable for a published MCP server operator, not a substitute for a local config or supply-chain scanner.

5. MCPSafe — package registry scanner

MCPSafe scans MCP server packages — from GitHub, npm, PyPI, Docker Hub, or an MCP registry ID — for code-level vulnerabilities and behavioral threats. Its distinguishing feature is an AIVSS (AI Vulnerability Scoring System) score built on consensus from five independent LLM judges, which reduces the false-positive rate on soft behavioral findings like tool poisoning and obfuscated intent. Static checks (command injection, SSRF, path traversal, hardcoded secrets) run alongside the LLM analysis.

MCPSafe is purpose-built for pre-installation review: before you add a new MCP server to your stack, you can submit its package and get a verdict in under a minute for already-scanned packages (or within 20 minutes for a fresh deep scan). It is not designed as a local config scanner or a live deployment gate.

Side by side

	Keelix	Snyk agent-scan	Cisco MCP Scanner	AgentGrade	MCPSafe
What it scans	Live box: host config, containers, exposure, MCP configs, agent posture	Local MCP configs + agent skills (Claude, Cursor, Windsurf, Gemini CLI…)	MCP server source/packages for YARA/LLM-detected threats	Live MCP server endpoints: HTTPS, auth, CORS, credential exposure	MCP server packages (GitHub/npm/PyPI/Docker): code vulns + behavioral threats
Scope	Whole box (host + containers + exposure + AI/MCP)	MCP config on the current machine only	MCP server definition in isolation	External HTTP surface of a published MCP server	MCP server source code in isolation
Prompt injection / tool poisoning	✓ Flags unvetted MCP servers + injection patterns	✓ 15+ risk categories including tool poisoning, toxic flows	✓ YARA + LLM-judge + Cisco AI Defense API	✗ Not checked (HTTP-surface checks only)	✓ Consensus of five LLM judges
Auto-approval / permissions	✓ Detects agents running with all tool calls auto-approved	✓ Credential handling + over-permissive config checks	✗ Not checked	✗ Not checked	✓ Excessive access rights
Plaintext secrets in config	✓ Redacts at scan boundary; never leaves box	✓ Hardcoded secrets flagged	✓ Hardcoded secrets flagged	✓ Credential exposure via HTTP headers	✓ Hardcoded secrets
Host config / outside-in exposure	✓ 93 CIS/SOC 2/ISO 27001 checks + open-port scan	✗ Not scanned	✗ Not scanned	✗ Not scanned	✗ Not scanned
CVE / package vulnerability	✓ Host OS packages (posture checks)	✗ Not scanned	✓ pip-audit CVE/PYSEC/GHSA for Python deps	✗ Not scanned	✗ Not scanned
Output / scoring	0–100 whole-box posture score + per-finding report (JSON/HTML)	CLI report of findings by risk category	Per-finding CLI/REST report	A–F letter grade on 14 HTTP-surface criteria	AIVSS score (0–10, lower is safer) per package
CI gate	✓ Exit code on posture threshold + GitHub Action	✓ Exit code on findings	✓ Exit code on findings	✗ Web dashboard, no CI integration	✗ API / badge, no native CI gate
Credentials required	None — runs fully local	SNYK_TOKEN required (free tier available)	Optional (YARA/readiness work without keys)	None — web-based	None for public packages
License / pricing	Apache-2.0 CLI free; Keelix Cloud for history + teams	Apache-2.0; Snyk account required	Apache-2.0; free	Free (web dashboard)	Free for public packages

Which to run, and when

A layered approach covers all three attack surfaces:

Before installing a new MCP server — submit it to MCPSafe and run Cisco MCP Scanner to check the source for supply-chain risks.
On developer machines — run Snyk agent-scan to find risky configs in Claude, Cursor, or Windsurf before those configs reach staging.
In CI, at deploy time — run Keelix on the staging box to confirm the whole deployment — host, containers, open ports, and the AI agents configured on it — clears your posture threshold before promotion to production.
For a published MCP server you operate— run AgentGrade to verify the endpoint's HTTP security surface (HTTPS, auth, CORS) is clean.

Most teams running self-hosted AI workloads will combine at least two of these. The supply-chain tools and the deployment-gate tools operate at different times in the lifecycle and on different inputs — they do not overlap.

Frequently asked

Which MCP security scanner should I use?: It depends on what you are protecting. If you are shipping an MCP server package, MCPSafe and Cisco MCP Scanner check the source for code-level vulnerabilities and behavioral threats before it reaches users. If you want to audit MCP configs on a developer machine, Snyk agent-scan auto-discovers Claude/Cursor/Windsurf configs and checks them for 15+ risk categories. If you are running a self-hosted server and need to know whether the whole box — host, containers, exposure, and AI agents together — is fit to ship, Keelix is the only tool that folds all of that into a single posture score. Most teams running AI workloads on self-hosted infrastructure will want at least two of these.
Do any of these scanners require an API key?: Snyk agent-scan requires a SNYK_TOKEN (a free Snyk account provides one). Cisco MCP Scanner works without any credentials for its YARA and readiness checks; the LLM-judge and Cisco AI Defense analyzers are optional and require their own keys. Keelix, AgentGrade, and MCPSafe run without credentials for their core functionality.
Does scanning MCP servers in CI actually block attacks?: Supply-chain scanning (MCPSafe, Cisco MCP Scanner) catches poisoned or malicious MCP server packages before they reach your environment. Config-level scanning (Snyk agent-scan, Keelix) catches risky configurations that were provisioned at deploy time — auto-approval, plaintext secrets, unvetted servers. Both layers matter, but they address different attack surfaces. A scanner that only looks at the code misses the configuration risk; a scanner that only looks at configuration misses the supply-chain risk.
What is the difference between Keelix and Snyk agent-scan?: Snyk agent-scan is a developer-time tool: it reads the MCP server configs on your current machine and flags risky entries — tool poisoning patterns, hardcoded secrets, over-permissive configs. It requires a Snyk API token and reports findings per server. Keelix is a deploy-time tool: it scans the running box — host config, open ports, container posture, and MCP configs together — and produces a single 0–100 score you can gate CI on. They are complementary: Snyk catches MCP-level issues early; Keelix confirms the whole deployment is safe.
Is AgentGrade an MCP security scanner?: AgentGrade grades the HTTP surface of a published MCP server endpoint — HTTPS, authentication headers, CORS policy, credential exposure in responses. It is useful for checking whether a deployed server is accessible securely. It does not scan source code, scan local configs, or assess the host environment. Think of it as a TLS/auth hygiene checker for the server's public endpoint rather than a deep security scanner.

Add the only whole-box MCP posture gate.

Free, local-first, Apache-2.0. Runs alongside Snyk and Cisco scanner — not instead of them.

operator@host — keelix

# install — free & open source (Apache-2.0)

$ curl -fsSL https://keelix.dev/install.sh | sh

$ keelix scan

Get started Pricing