Catch risky AI agents and MCP servers before they ship.
Host scanners check containers and ports. They are completely blind to the AI agents and MCP servers running on the same box. Keelix is the only tool that grades that surface and folds it into a whole-box 0–100 posture score — runnable as a CI gate before anything goes live.
The surface nobody else checks
When you run Trivy, Grype, or Docker Scout, you get a CVE report on your container images. What you don't get: any signal about the MCP server your team wired up last Tuesday that auto-approves every tool call, or the Claude Code config file storing a plaintext Anthropic API key next to a database password.
That gap is not an edge case. It is the new default attack surface for any team shipping AI-assisted products on self-hosted infrastructure.
What Keelix grades
Four risk categories, each deterministically checked — same input, same verdict, every run. Each finding maps to a SOC 2, ISO 27001, or CIS control.
Agent auto-approval
Detects agents configured to approve all MCP tool calls without user confirmation. The biggest single amplifier of blast radius — a single prompt injection goes from annoying to catastrophic when no human is in the loop.
What is auto-approval? →The lethal trifecta
Checks whether a deployed agent has all three legs: access to private data, exposure to untrusted input, and a reachable exfiltration channel. Coined by Simon Willison. All three present = high-severity finding.
Full explainer →Plaintext secrets in MCP config
Reads the MCP config paths used by Claude Code, Cursor, Windsurf, and other agents on the box. Flags any API keys or tokens stored in plaintext. Redacts them at the scan boundary — they never leave your machine.
How secrets end up in MCP config →Unvetted MCP servers
Cross-references installed MCP servers against known publishers. Flags servers with no verified publisher, recently published packages with no history, and servers whose tool descriptions contain known injection patterns.
In your CI
Keelix ships as a single statically linked binary and a GitHub Action. Drop it into your pipeline after deploy-to-staging and before promote-to-production. Set a threshold — say, posture score ≥ 80 — and the gate blocks automatically if any of the four MCP risk categories pushes the score below it.
The exit code is machine-readable (0 = cleared, 1 = failed). The report is shareable — JSON, HTML, or the human-readable scan record format — so the finding that triggered the block is visible to reviewers without running the scanner again.
- name: Keelix posture gate
uses: jakelamon/keelix@v0.1.0
with:
threshold: 80
fail-on: mcp-auto-approval,mcp-secretsNeed a lower-level gate? See how Keelix compares to Trivy — complementary tools, different surfaces.
How it differs from point tools
Cisco's mcp-scanner and Snyk's agent-scan are solid pre-deploy tools that analyze an MCP server definition in isolation — checking for prompt-injection patterns, tool poisoning, and known CVEs in dependencies. Use them.
What they don't do is grade the live deployment context: whether auto-approval is active on this box, whether that server is exposed to the internet, whether the host running it has unpatched CVEs or a misconfigured firewall, and how all of that rolls up to a single number you can gate on. That is Keelix's job.
The two approaches are complementary. Run Cisco/Snyk at dev time to catch poisoned tool descriptions before they merge. Run Keelix at deploy time to confirm the whole box — host, containers, services, and agents — is fit to ship.
Frequently asked
- How do I scan an MCP server for vulnerabilities?
- Run `keelix scan` on the host where your AI agent or MCP server is installed. Keelix discovers all MCP server configs on the box, grades each one for auto-approval, plaintext secrets, unvetted publishers, and prompt-injection risk (the lethal trifecta), and folds the result into a single 0–100 posture score. No separate login or API token required — it runs entirely locally.
- Are MCP servers safe?
- By default, no. Trend Micro found 492 publicly reachable MCP servers with zero client authentication or traffic encryption. GitGuardian's 2026 report identified 24,008 unique secrets in MCP config files on public GitHub — 2,117 confirmed valid credentials. The protocol itself is young and the tooling ecosystem has not kept pace with security requirements. Keelix grades the MCP servers already deployed on your box rather than those on the public internet.
- Is there an open-source MCP security scanner?
- Yes — Cisco's mcp-scanner (Apache-2.0) and Snyk's agent-scan both scan MCP server definitions for prompt-injection patterns, tool poisoning, and known CVEs in dependencies. Both are pre-deploy, point-in-time tools: they inspect a server definition in isolation. Keelix does something different: it grades all MCP servers on a live box together, cross-references them with the host and container posture, and emits a single score you can gate CI on.
- How do I detect plaintext secrets in MCP config?
- Run `keelix scan`. Keelix reads the MCP config paths used by Claude Code, Cursor, Windsurf, and other agents on the box, redacts secrets at the scan boundary, and flags any API keys or tokens found in plaintext. The finding maps to a SOC 2 / CIS control and appears in the posture report with remediation guidance.
Related
- The Lethal Trifecta — what it is and how Keelix detects it
- Agent auto-approval — the silent risk multiplier
- Plaintext secrets in MCP config — blast radius and remediation
- AI/MCP Security Glossary — tool poisoning, lethal trifecta, and more
- Keelix vs Trivy — complementary tools, different surfaces
- Pricing — the CLI is free and Apache-2.0
Grade your MCP surface in under two minutes.
Free, local-first, Apache-2.0. Nothing leaves your box.