Keelix vs Cisco MCP Scanner

Cisco MCP Scanner answers: “Does this MCP server's source code or tool definitions contain supply-chain threats, malicious patterns, or prompt injection vulnerabilities?” It connects to MCP servers — or scans offline JSON — and runs three complementary engines: YARA rules for pattern-based threat detection, an LLM-as-judge for semantic analysis of whether a tool's implementation matches its stated description, and the Cisco AI Defense API for threat intelligence. It also checks Python dependencies for known CVEs and vulnerabilities. Apache-2.0, genuinely capable at supply-chain analysis, and the right tool for auditing an MCP server before it reaches production.

Keelix answers: “Is this deployed box fit to ship — including the AI agents and MCP servers running on it right now?” It scans from outside the box in, audits host config against 93 CIS/SOC 2/ISO 27001 controls, checks what ports are actually reachable from the internet, and grades every AI agent and MCP server on the machine for auto-approval state, plaintext secrets in config files, and the lethal trifecta. The result is a single 0–100 score you can gate CI on — with no account required and nothing leaving your box.

The gap between the two tools is deployment context. Cisco MCP Scanner can tell you an MCP server's tool implementations look suspicious in isolation. It cannot tell you whether auto-approval is actually active on the box where that server is running, or whether that box has port 2375 reachable from the open internet. That gap is exactly what Keelix closes.

Cisco MCP Scanner was built for a problem that is genuinely hard: detecting malicious intent in MCP server code before it reaches production. Its behavioral analysis engine is particularly capable — it tracks data flow across files, builds control-flow graphs, runs taint analysis, and flags mismatches between what a tool claims to do in its description and what the code actually does. That kind of static analysis catches a class of threats that live-deployment scanning fundamentally cannot: a server that looks benign until it silently exfiltrates data on the twenty-third call.

The three-engine architecture also gives teams flexibility. The YARA and LLM-as-judge engines run fully locally with no external credentials. The Cisco AI Defense API engine adds Cisco's threat intelligence layer for teams that have the account. You can run useful supply-chain analysis without touching Cisco's cloud at all — which matters in air-gapped or highly regulated environments.

For teams building MCP servers, consuming third-party MCP servers, or evaluating whether an external tool is safe to add to an agent's allowed list, Cisco MCP Scanner is the right first step.

After Cisco MCP Scanner clears an MCP server's definitions and code, there are deployment-context questions that supply-chain analysis cannot answer:

• Is the MCP server on this box configured with auto-approval active? A clean supply-chain verdict with auto-approval enabled means any prompt injection that slips through turns into unconstrained tool execution.
• Does the Claude Code or Cursor config file on this host contain a plaintext Anthropic API key or database password? Secrets in MCP config files are a deployment-time exposure that no amount of source-code analysis will surface.
• Is this box missing the firewall controls that prevent Docker from silently binding containers to 0.0.0.0 and bypassing UFW? Port 2375 reachable from the open internet is a finding that lives at the infrastructure layer, not the server definition layer.
• Does the deployed agent have all three legs of the lethal trifecta active simultaneously — private data access, untrusted input exposure, and an open exfiltration channel? The combined deployment-context risk is only visible on the live box.

None of these are source-code or supply-chain issues. All of them are deployment-context issues. They show up at runtime, on the box, in the config that was provisioned after the image was built and before the server definitions were audited. That is exactly what Keelix scans.

A practical pipeline for teams running AI agents on self-hosted infrastructure: Cisco MCP Scanner runs at development or code-review time to audit MCP server source code and tool definitions for supply-chain threats — before the server is deployed anywhere. Keelix runs in the deploy-to-staging stage to confirm the live box — host config, exposure, and every agent running on it — meets the posture threshold before promote-to-production.