How do I use MCP Shield?

1. Click on "Install Server". 2. Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state. 3. In the chat, type @ followed by the MCP server name and your instructions, e.g., "@MCP Shield scan the current directory for security risks" That's it! The server will respond to your query, and you can continue using it as needed. Here is a step-by-step guide with screenshots.

MCP Shield

by rob925

Overview Schema Related Servers Score Discussions

Python

Local

MCP Shield

Python License: MIT MCP

Security scanner and MCP server for Model Context Protocol servers, tools, prompts, and AI agent projects.

MCP gives agents access to tools. MCP Shield helps you catch the obvious dangerous parts before they reach production: leaked secrets, shell execution, risky tool descriptions, prompt-injection text, and CI-breaking security regressions.

mcp-scan .

[HIGH] code.shell_true server.py:42
  Shell execution is enabled.
  subprocess.run(cmd, shell=True)

[CRITICAL] secret.literal .env:1
  Possible hard-coded secret.
  OPENAI_API_KEY="sk-..."

Why MCP Shield

MCP servers often expose powerful capabilities: filesystem access, shell commands, network calls, credentials, browser automation, databases, and internal tools.

That is exactly where small mistakes become expensive:

a tool description encourages unsafe behavior
a test key becomes a real leaked token
an agent can call a shell command with user-controlled input
a prompt or resource contains injection text
CI has no security gate for MCP-specific risks

MCP Shield is the simple first line of defense: fast static checks, useful output, and a non-zero exit code when risk crosses your threshold.

Related MCP server: Mund

Features

runs as both a CLI and an MCP server
built on the official MCP Python SDK
CI-friendly severity gates
text, JSON, Markdown, and SARIF output
inline suppressions with rule IDs
.mcp-scan-ignore for fixtures and intentional demos

What It Finds

Risk	Examples
Hard-coded secrets	API keys, tokens, passwords, private keys
Process execution	`subprocess`, `child_process`, `shell=True`
MCP tool risk	tools named or described as delete, shell, token, secret, filesystem
Environment access	`os.environ`, `process.env`
Prompt injection text	"ignore previous instructions", system prompt leakage phrases

Install

From a local checkout:

pip install .

Run without installing:

python -m mcp_security_scanner.cli .

MCP Server

Run MCP Shield as a stdio MCP server:

mcp-shield-server

Available tools:

scan_path_tool - scan a local MCP server or agent project
list_rules - list rule IDs and descriptions

Example Claude Desktop-style command:

{
  "mcpServers": {
    "mcp-shield": {
      "command": "mcp-shield-server"
    }
  }
}

Usage

mcp-scan .
mcp-scan path/to/mcp-server
mcp-scan . --format json
mcp-scan . --format markdown --output mcp-security-report.md
mcp-scan . --format sarif --output mcp-shield.sarif
mcp-scan . --fail-on medium

Formats:

text for humans
json for automation
markdown for PR comments and reports
sarif for GitHub code scanning

Severity gates:

low
medium
high
critical

--fail-on high exits with code 1 when any high or critical finding exists.

Ignore Files

Create .mcp-scan-ignore in the scanned directory:

tests/
fixtures/
examples/unsafe-demo.py

Use this for intentional fixtures and demos. Do not use it to hide production risks.

Suppressions

Suppress a reviewed finding on the same line:

subprocess.run(cmd)  # mcp-shield: ignore code.subprocess

Use all only for test fixtures:

subprocess.run(cmd, shell=True)  # mcp-shield: ignore all

Example

Scan the intentionally unsafe example:

python -m mcp_security_scanner.cli examples/unsafe-mcp-server --fail-on critical

GitHub Actions

name: MCP security scan

on: [push, pull_request]

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"
      - run: pip install .
      - run: mcp-scan . --fail-on high

Roadmap

MCP SDK-aware parsing for Python and TypeScript servers
safer default rule pack for enterprise MCP servers
prompt/resource-specific injection checks
PyPI release for pipx install mcp-shield

Repository Topics

Add these GitHub topics for discovery:

mcp, model-context-protocol, ai-agents, security, security-tools, scanner, devtools, llm, prompt-injection, static-analysis

GitHub recommends repository topics because they help people discover and contribute to projects by purpose and subject area.

Scope

MCP Shield is a static heuristic scanner. It catches common risks early, but it is not a full security audit.

Help It Grow

MCP security is moving fast. The most useful contributions right now are real-world unsafe MCP examples, low-noise detection rules, and CI integrations.

If MCP Shield catches something useful, star the repo so more MCP builders can find it.

Available Tools

2 tools

list_rulesA

List MCP Shield rule IDs and descriptions.

ParametersJSON Schema

Name	Required	Description	Default
No parameters

TDQS

A3.6/5.0

Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries full burden but only states that the tool 'lists' data, implying a read-only operation. It does not disclose any behavioral traits such as authentication requirements, rate limits, or whether results are paginated.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence with no unnecessary words. It is front-loaded with the key action 'List' and immediately states the objects and output, making it efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (no parameters, no output schema, no annotations), the description covers the essential information. It could mention the structure of the output or any implied constraints, but it is largely complete for a list operation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, so the description adds no additional parameter meaning beyond the schema. Baseline is 4 per guidelines, and the description's mention of 'rule IDs and descriptions' clarifies what output to expect.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description explicitly states the tool lists 'MCP Shield rule IDs and descriptions', providing a specific verb and resource. It distinguishes well from the sibling tool 'scan_path_tool' which likely deals with scanning paths rather than rules.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is given on when to use this tool versus alternatives. There is no mention of context, prerequisites, or exclusions, leaving the agent to infer usage solely from the tool name and purpose.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

scan_path_toolC

Scan a local MCP server or agent project for security risks.

ParametersJSON Schema

Name	Required	Default
`path`	No	.
`fail_on`	No	high
`output_format`	No	text

TDQS

C2.4/5.0

Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so the description carries full burden. It only says 'scan', which implies read-only, but does not disclose whether it modifies files, requires permissions, or any side effects.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence, which is concise, but it lacks structural detail. It does not earn its place fully as it omits critical information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With three parameters and no output schema or annotations, the description is insufficient. It does not explain what risks are scanned, output formats, or fail_on severity levels.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, and the description provides no explanation for the three parameters (path, fail_on, output_format). The agent gets no help on how to fill them correctly.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool scans for security risks in local MCP server or agent projects. It distinguishes from the sibling tool 'list_rules' which likely only lists rules.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool versus alternatives or any prerequisites. The description does not mention context or exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.

2 tool updatesv0.1.0Jul 10, 2026
- First observedlist_rules
- First observedscan_path_tool

Install Server

RayrunBuild, deploy, and operate MCP servers without becoming an infrastructure team.ray.runAd

TDQS

C2.9/5.0

Disambiguation5/5

The two tools have clearly distinct purposes: one lists all rule IDs and descriptions, the other scans a specific path. No overlap in functionality.

Naming Consistency4/5

Both tools use snake_case and a verb_noun pattern. 'scan_path_tool' has an extra '_tool' suffix, but this is a minor deviation from the pattern of list_rules.

Tool Count2/5

Only 2 tools for a security-focused MCP server is very limited. A typical security tool would require additional actions like rule details, scan results, or configuration.

Completeness2/5

The server lacks essential operations: ability to get details of individual rules, view scan results, configure scans, or take actions based on findings. Significant gaps for a security scanning server.

Maintenance

ActivitySlowing

ResponsivenessSyncing

Resources

GitHub Repository

Need Help?

Related Servers

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

MCP FortressOAuth
io.github.mcp-fortress
Security scanner for MCP servers. Detect vulnerabilities, prompt injection, and tool poisoning.
Security Testing & QA Tools Penetration Testing
2
Frogeye Security Scanner A
io.github.frogeye-ai
Zero-config MCP security scanner for AI-generated apps. 25K+ vulnerability patterns.
Security Penetration Testing
2
shadowgate-mcp
io.github.josephibra
Security firewall for AI agents — scans MCP calls for injection, secrets, and risks.
Security Monitoring
2
mcpcheck B
io.github.joeyough
Scan any MCP server for tool-poisoning, security, auth & license. Trust score before install.
Penetration Testing Security
21

Related MCP Servers

project-shield
Security Testing & QA Tools Code Analysis
Whitening-Sinabro
A
license
Not graded
quality
C
maintenance
Security scanner for MCP servers and AI-generated code. Detects leaked API keys, PII, prompt injection, and MCP misconfigs with A-F security grades.
Updated 24 days ago (2026-08-12 18:57 UTC)
MIT
Mund
Security Testing & QA Tools Autonomous Agents
Tyox-all
A
license
Not graded
quality
A
maintenance
MCP security scanner for AI agents - detects prompt injection, secrets, PII, and vets MCP servers before installation
Updated 13 days ago (2026-08-24 15:08 UTC)
Apache 2.0
tooltrust-mcp
AI & Machine Learning Security Testing & QA Tools
AgentSafe-AI
A
license
Not graded
quality
A
maintenance
Scans MCP servers for prompt injection, supply chain attacks, excessive permissions, and code execution risks. Includes an offline blacklist that catches known-compromised packages like LiteLLM 1.82.7/1.82.8 and Trivy with zero latency.
Updated 2 days ago (2026-09-04 14:18 UTC)
19
MIT
agent-audit
Penetration Testing Security
piiiico
A
license
Not graded
quality
C
maintenance
Security scanner for MCP servers. Detects prompt injection, command injection, auth bypass, and excessive permissions across tools, resources, and prompts.
Updated 4 months ago (2026-05-04 22:47 UTC)
26
2
MIT

Latest Blog Posts

Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)
By Om-Shree-0709 on July 25, 2026.
mcp
Agent Identity
OAuth 2.1
Your AI Chatbot Just Exposed Your CEO's Salary to an Intern
By Om-Shree-0709 on July 2, 2026.
Agent Identity
MCP Security
OAuth Delegation
Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)
By Om-Shree-0709 on June 30, 2026.
Agentic Ai
Prompt Injection
WebAssembly

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/rob925/mcp-shield'

If you have feedback or need assistance with the MCP directory API, please join our Discord server

MCP Shield

Why MCP Shield

Features

What It Finds

Install

MCP Server

Usage

Ignore Files

Suppressions

Example

GitHub Actions

Roadmap

Repository Topics

Scope

Help It Grow

Available Tools

TDQS

TDQS

Tool Schema Changelog

TDQS

Maintenance

Resources

Looking for Admin?

Related MCP Connectors

Related MCP Servers

project-shield

Mund

tooltrust-mcp

agent-audit

Latest Blog Posts

MCP directory API