Which integrations are available for this server?

Integrates with GitHub Actions for automated security scanning in CI/CD pipelines and supports SARIF output for integration with GitHub Code Scanning.

teeshield

by teehooai

Overview Schema Related Servers Score Discussions

Python

Hybrid

SpiderShield -- Security Scanner & Runtime Guard for MCP Servers

SpiderShield Verified PyPI License: MIT

Security toolkit for MCP servers and AI agents. Static analysis, runtime policy enforcement, DLP, and audit logging -- from development to production.

Security Contributions

SpiderShield has identified and fixed vulnerabilities in these projects (merged PRs):

Project	Stars	Fix
upstash/context7	49K+	Path traversal (CWE-22)
moeru-ai/airi	35K+	Timing attack (CWE-208)
topoteretes/cognee	--	Command injection (CWE-78)
Flux159/mcp-server-kubernetes	1.3K+	Timing attack (CWE-208)
agentic-community/mcp-gateway-registry	--	Shell injection (CWE-78)

Related MCP server: meok-mcp-injection-scan-mcp

What SpiderShield does

SpiderShield is a 5-subsystem security toolkit:

Subsystem	Command / API	What it does
Static Scanner	`spidershield scan`	Score tool descriptions, detect code vulnerabilities, rate overall quality (F/C/B/A/A+)
Agent Security	`spidershield agent-check`	18 config checks, 15 malicious pattern detections, toxic flow analysis, rug pull detection
Runtime Guard SDK	`SpiderGuard(policy="balanced")`	Pre/post-execution policy enforcement for tool calls
MCP Proxy	`guard_mcp_server(cmd)`	Transparent security proxy between agent and MCP server
DLP Engine	Built into Guard SDK	Scan tool outputs for PII/secrets, redact or block

Install

pip install spidershield

Requires Python 3.11+. See SUPPORT.md for version compatibility and optional dependencies.

5-Minute Success Path

# 1. Install
pip install spidershield

# 2. Scan any MCP server
spidershield scan ./your-mcp-server

# 3. See what's wrong and how to fix it
spidershield rewrite ./your-mcp-server --dry-run

# 4. (Optional) Protect at runtime
spidershield proxy -- npx server-filesystem /tmp

For contributors:

git clone https://github.com/teehooai/spidershield && cd spidershield
make verify-oss   # One command: install + lint + type check + test + scan

Quick Start

Static scan (CI / development)

spidershield scan ./your-mcp-server

Example output:

            SpiderShield Scan Report
   modelcontextprotocol/servers/filesystem
+---------------------------------------------+
| Metric                | Value     |   Score |
|-----------------------+-----------+---------|
| License               | MIT       |      OK |
| Tools                 | 14        |      OK |
| Security              | 0 issues  | 10.0/10 |
| Descriptions          |           |  3.2/10 |
| Architecture          |           | 10.0/10 |
| Tests                 | Yes       |      OK |
|                       |           |         |
| Overall               | Rating: B |  7.6/10 |
| Improvement Potential |           |  2.4/10 |
+---------------------------------------------+

Runtime Guard SDK (production)

Enforce security policies on every tool call at runtime:

from spidershield import SpiderGuard, Decision

guard = SpiderGuard(policy="strict")

result = guard.check("read_file", {"path": "/etc/passwd"})
if result.decision == Decision.DENY:
    print(result.reason)       # "System file access blocked"
    print(result.suggestion)   # "Use application-level files instead"

Policy presets:

Preset	Behavior
`strict`	Deny by default, explicit allow list
`balanced`	Block known-dangerous patterns, allow common operations
`permissive`	Warn on suspicious patterns, allow most operations
Custom YAML	Load your own policy file: `SpiderGuard(policy="my-policy.yaml")`

With audit logging and DLP:

guard = SpiderGuard(
    policy="strict",
    audit=True,              # Write audit trail to disk
    audit_dir="./logs",      # Custom audit directory
    dlp="redact",            # Scan outputs for PII/secrets, redact matches
)

# Pre-execution check
result = guard.check("query_db", {"sql": "SELECT * FROM users"})

# Post-execution DLP scan
clean_output = guard.after_check("query_db", raw_result)

With data flywheel (opt-in telemetry to local SQLite):

guard = SpiderGuard(policy="balanced", dataset=True)
# Every check() call feeds the local dataset for scoring calibration

MCP Proxy (transparent protection)

Wrap any MCP server with SpiderShield policy enforcement:

from spidershield import guard_mcp_server

# Proxy between agent and server, enforcing "balanced" policy
guard_mcp_server(
    ["npx", "server-filesystem", "/tmp"],
    policy="balanced",
    audit=True,
)

Or from the CLI:

spidershield proxy -- npx server-filesystem /tmp --policy balanced

Rewrite tool descriptions

SpiderShield can automatically rewrite tool descriptions to be action-oriented, with scenario triggers, parameter examples, and error guidance.

# Preview changes (no files modified)
spidershield rewrite ./your-mcp-server --dry-run

# Apply changes to source files
spidershield rewrite ./your-mcp-server

Before (score 2.9):

"Shows the working tree status"

After (score 9.6):

"Query the current state of the Git working directory and staging area.
 Use when the user wants to check which files are modified, staged, or
 untracked before committing."

The rewriter works offline using templates (zero cost). Set ANTHROPIC_API_KEY for higher-quality LLM-powered rewrites.

Scan results across the MCP ecosystem

Server	Tools	Security	Descriptions	Overall	Rating
filesystem	14	10.0	3.2	7.6	B
git	12	10.0	2.4	7.3	B
memory	9	10.0	2.3	7.3	B
fetch	1	9.0	3.5	7.3	B
supabase	30	9.0	2.3	6.4	B

Full report: MCP-SECURITY-REPORT.md | Raw data: CURATION-REPORT.md

Try it on an example

The repo includes example MCP servers for instant demo:

git clone https://github.com/teehooai/spidershield
cd spidershield

spidershield scan examples/insecure-server   # Rating: D (3.3/10)
spidershield scan examples/secure-server     # Rating: D (4.7/10)

What SpiderShield checks

Static Scanner

Security (weighted 35%)

Path traversal
Command injection / dangerous eval
SQL injection (Python + TypeScript)
SSRF (unrestricted network access)
Hardcoded credentials
Unsafe deserialization (pickle, yaml.load)
Prototype pollution (TypeScript)

Descriptions (weighted 35%)

Action verb starts ("List", "Create", "Execute")
Scenario triggers ("Use when the user wants to...")
Parameter documentation
Parameter examples
Error handling guidance
Disambiguation between similar tools
Length (too short = vague, too long = noisy)

Architecture (weighted 30%)

Test coverage (gradual: count-based)
Error handling (gradual: coverage-based)
README quality (gradual: length-based)
Type annotations
Dependency management
Environment configuration

License (pass/fail gate, not weighted)

MIT, Apache-2.0, BSD = OK
GPL, AGPL = warning
Missing = fail

Agent Security Checker

Scan AI agent installations for security misconfigurations and malicious skills.

spidershield agent-check ~/.openclaw

What it checks:

10 configuration security checks (auth, sandbox, SSRF, permissions, etc.)
20+ malicious skill patterns (reverse shells, credential theft, prompt injection)
Toxic flow detection -- flags skills that can read sensitive data AND send it externally
Typosquat detection for skill names
Excessive permission requests

Advanced options:

# Verify skill integrity (rug pull detection)
spidershield agent-check --verify

# Only approved skills allowed
spidershield agent-check --allowlist approved.json

# Strict mode: fail on any finding
spidershield agent-check --policy strict

# Ignore specific rules
spidershield agent-check --ignore TS-W001 --ignore typosquat

# Auto-fix configuration issues
spidershield agent-check --fix

# SARIF output for GitHub Code Scanning
spidershield agent-check --format sarif > results.sarif

Skill pinning (rug pull protection):

spidershield agent-pin add ~/.openclaw/skills/my-skill/SKILL.md
spidershield agent-pin add-all
spidershield agent-pin verify    # detect tampered skills
spidershield agent-pin list

46 standardized issue codes across 4 categories:

Code	Category	Example
TS-E001~E015	Error (malicious)	Reverse shell, credential theft, prompt injection
TS-W001~W011	Warning (suspicious)	Typosquat, toxic flow, unapproved skill
TS-C001~C018	Config	No auth, sandbox disabled, SSRF enabled
TS-P001~P002	Pin	Verified, tampered

Rating scale (SpiderRating)

Rating	Score	Meaning
A	9.0+	Exemplary
B	7.0+	Production-ready
C	5.0+	Usable, needs improvements
D	3.0+	Significant issues
F	<3.0	Unsafe, do not deploy

Formula (MCP servers): description × 0.38 + security × 0.34 + metadata × 0.28 Formula (Skills): description × 0.45 + security × 0.35 + metadata × 0.20

JSON output

spidershield scan ./server --format json
spidershield scan ./server --format json -o report.json

GitHub Action

Add SpiderShield to your CI pipeline. Available on the GitHub Marketplace.

Basic usage

# .github/workflows/security.yml
name: SpiderShield Security Scan
on: [push, pull_request]

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: teehooai/spidershield@v1
        with:
          target: '.'
          fail-below: '6.0'

With outputs

- uses: actions/checkout@v4
- id: scan
  uses: teehooai/spidershield@v1
  with:
    target: '.'
    fail-below: '6.0'
    format: 'json'
- run: |
    echo "Score: ${{ steps.scan.outputs.score }}"
    echo "Rating: ${{ steps.scan.outputs.rating }}"

Action inputs

Input	Description	Default
`target`	Path to MCP server directory	`.`
`fail-below`	Fail if score is below this threshold (0-10)	`0` (never fail)
`format`	Output format (`table` or `json`)	`table`

Action outputs

Output	Description
`score`	Overall scan score (0-10)
`rating`	Rating: F / C / B / A / A+
`tool-count`	Number of tools detected

Commands

Command	Description
`spidershield scan <path>`	Scan and rate an MCP server
`spidershield rewrite <path>`	Rewrite tool descriptions
`spidershield harden <path>`	Suggest security hardening (advisory only)
`spidershield eval <original> <improved>`	Compare tool selection accuracy
`spidershield agent-check [dir]`	Scan an AI agent for security issues
`spidershield agent-pin <cmd>`	Manage skill pins for rug pull detection
`spidershield guard -- <cmd>`	Wrap any subprocess with security guard
`spidershield proxy -- <cmd>`	MCP proxy with policy enforcement
`spidershield policy list\|show\|validate`	Manage security policies
`spidershield audit show\|stats`	View guard audit logs
`spidershield dataset stats`	View data flywheel statistics
`spidershield dataset benchmark-add`	Add a benchmark entry
`spidershield dataset benchmark-run`	Re-run benchmarks
`spidershield dataset calibrate`	Run scoring calibration

Threat model

SpiderShield provides both static analysis and runtime policy enforcement.

What it catches:

Ambiguous tool definitions that lead to agent misuse
Missing side-effect declarations (writes, deletes, network calls)
Unsafe permission patterns (unbounded file access, unrestricted queries)
Vague descriptions that give agents no operational boundaries
Malicious agent skills (reverse shells, credential theft, prompt injection)
Dangerous capability combinations (data exfiltration flows)
Insecure agent configurations (no auth, disabled sandbox, open DM policy)
Skill tampering (rug pull detection via content hashing)
PII/secret leakage in tool outputs (DLP engine)
Policy violations at runtime (Runtime Guard)

What it does NOT do:

Network traffic monitoring
Container-level sandboxing
Access control management (it enforces policies, not manages identities)

License

MIT

Available Tools

2 tools

check_agent_securityA

Scan an AI agent installation for security issues. Checks agent configuration (gateway binding, authentication, sandbox, API keys in plaintext, DM policy, tool permissions, SSRF protection, file permissions, log redaction) and installed skills for malicious patterns (reverse shells, credential theft, prompt injection, toxic data flows). Returns findings with severity levels and fix hints. Use when auditing an agent's security posture or before deploying an agent to production.

ParametersJSON Schema

Name	Required	Description
`agent_dir`	No	Path to agent config directory. Defaults to ~/.openclaw if not specified.
`scan_skills`	No	Include skill scanning for malicious patterns (default: true)
`verify_pins`	No	Verify pinned skills for rug pull detection (default: false)
`policy`	No	Scan policy preset (default: balanced)

TDQS

A4.2/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Without annotations, the description adequately discloses the tool's behavior: it scans configuration and skills, and returns findings with severity and fix hints. It implies a read-only operation, though explicitly stating non-destructiveness would improve transparency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise: two sentences for the main functionality and one for usage. Every sentence provides value, no redundancy, and the structure is front-loaded with the core purpose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema, the description covers the return format (findings with severity and fix hints). It adequately describes the tool's scope and outcome, though it could mention the sibling tool to avoid confusion.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents each parameter well. The description adds overall context but does not enhance parameter semantics beyond what the schema provides, meeting the baseline.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'scan' and the resource 'AI agent installation'. It lists specific security checks on configuration and skills, distinguishing it from the sibling tool 'scan_mcp_server' which likely scans MCP servers instead.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit usage guidance is provided: 'Use when auditing an agent's security posture or before deploying an agent to production.' This gives clear context but does not mention when not to use or alternative tools, such as the sibling for MCP servers.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

scan_mcp_serverA

Scan an MCP server for security vulnerabilities, description quality, and architecture issues. Checks for path traversal, command injection, SQL injection, SSRF, hardcoded credentials, and unsafe deserialization. Scores tool descriptions for scenario triggers, parameter docs, and disambiguation. Returns a security rating (F/C/B/A/A+) with actionable recommendations. Use when evaluating whether an MCP server is safe to install or deploy.

ParametersJSON Schema

Name	Required	Description	Default
`target`	Yes	GitHub repo URL or local directory path of the MCP server to scan

TDQS

A4.3/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries full burden. It explains the tool scans for specific vulnerabilities, scores descriptions, and returns a rating. It does not disclose whether it modifies files or requires network access, but overall it provides substantial behavioral insight.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise, with every sentence serving a purpose. It starts with the main action, lists what it checks, and ends with when to use it. No wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the simple one-parameter schema, no output schema, and no annotations, the description is complete. It explains the tool's purpose, checks, and output (security rating with recommendations). There are no apparent gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The single parameter 'target' is described in the schema as 'GitHub repo URL or local directory path'. The tool description does not add new meaning beyond that, so a baseline score of 3 is appropriate given 100% schema coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool scans MCP servers for security vulnerabilities, description quality, and architecture issues, listing specific checks and a rating system. It distinguishes itself from the sibling tool 'check_agent_security' by focusing on server security rather than agent security.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides a clear use case: 'Use when evaluating whether an MCP server is safe to install or deploy.' However, it does not mention when not to use this tool or contrast it with alternatives like the sibling tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.

2 tool updatesv0.3.4Apr 17, 2026
- First observedcheck_agent_security
- First observedscan_mcp_server

Install Server

RayrunBuild, deploy, and operate MCP servers without becoming an infrastructure team.ray.runAd

TDQS

A4.4/5.0

Disambiguation5/5

The two tools target completely different security domains—agent installations vs MCP servers—with no functional overlap. An agent can easily distinguish which to use based on the target.

Naming Consistency5/5

Both tools follow a consistent verb_noun pattern: check_agent_security and scan_mcp_server. The naming is predictable and immediately conveys purpose.

Tool Count4/5

With only two tools, the server is minimal but well-scoped to its purpose of security scanning. Each tool covers a distinct area, and adding more would risk bloat. However, a third tool for scanning server configurations could be justified.

Completeness4/5

The set covers the two primary use cases implied by the server name 'teeshield': scanning agents and scanning MCP servers. Agent scanning includes configuration and skills; MCP scanning includes vulnerabilities and description quality. Minor gaps like scanning for network security or runtime behavior might exist, but are outside the stated scope.

Maintenance

ActivityInactive

ResponsivenessUnresponsive

Resources

GitHub Repository

Need Help?

Related Servers

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

MCP FortressOAuth
io.github.mcp-fortress
Security scanner for MCP servers. Detect vulnerabilities, prompt injection, and tool poisoning.
Security Testing & QA Tools Penetration Testing
2
mcpcheck B
io.github.joeyough
Scan any MCP server for tool-poisoning, security, auth & license. Trust score before install.
Penetration Testing Security
21
Occludra — MCP Gateway (AI Security Gateway)
ai.occludra
Security & DLP proxy for MCP: tool-poisoning scans, PII redaction on tool args/results. Beta.
Security Agent Orchestration
1
Compuute MCP Security Scanner A
io.github.Compuute
Scan any public GitHub MCP-server repo for security issues. 37 MCP-specific L1 rules, 8 languages.
Security Code Analysis Version Control
12

Related MCP Servers

agent-audit
Penetration Testing Security
piiiico
A
license
Not graded
quality
C
maintenance
Security scanner for MCP servers. Detects prompt injection, command injection, auth bypass, and excessive permissions across tools, resources, and prompts.
Updated 4 months ago (2026-05-04 22:47 UTC)
26
2
MIT
meok-mcp-injection-scan-mcp
Penetration Testing Security
CSOAI-ORG
A
license
A
quality
C
maintenance
Scans MCP servers for prompt-injection, tool-poisoning, and SSRF vulnerabilities using 30+ canonical rules across 5 severity tiers, with optional signed safety reports for procurement.
Updated 3 months ago (2026-06-19 08:18 UTC)
5
MIT
mcp-heimdall
Penetration Testing Code Analysis
caglarbozkurt
A
license
Not graded
quality
A
maintenance
Security scanner for MCP servers — vet an MCP before you wire it into an agent. Detects prompt-injection, credential exfiltration (via taint analysis), RCE, and supply-chain risks, and catches cross-server exfil chains no single server reveals. Zero-dependency local CLI, SARIF output, CI-gateable, no account.
Updated 2 months ago (2026-07-06 16:19 UTC)
65
MIT
MCP Shield
Security Code Analysis CI/CD & DevOps
rob925
A
license
C
quality
B
maintenance
Security scanner and MCP server that catches dangerous patterns in MCP servers and AI agent projects, such as leaked secrets, shell execution, and prompt-injection text. Runs as both a CLI and MCP server with CI-friendly severity gates.
Updated 2 months ago (2026-07-10 14:06 UTC)
2
1
MIT

Latest Blog Posts

Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)
By Om-Shree-0709 on July 25, 2026.
mcp
Agent Identity
OAuth 2.1
Your AI Chatbot Just Exposed Your CEO's Salary to an Intern
By Om-Shree-0709 on July 2, 2026.
Agent Identity
MCP Security
OAuth Delegation
Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)
By Om-Shree-0709 on June 30, 2026.
Agentic Ai
Prompt Injection
WebAssembly

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/teehooai/spidershield'

If you have feedback or need assistance with the MCP directory API, please join our Discord server

SpiderShield -- Security Scanner & Runtime Guard for MCP Servers

Security Contributions

What SpiderShield does

Install

5-Minute Success Path

Quick Start

Static scan (CI / development)

Runtime Guard SDK (production)

MCP Proxy (transparent protection)

Rewrite tool descriptions

Scan results across the MCP ecosystem

Try it on an example

What SpiderShield checks

Static Scanner

Agent Security Checker

Rating scale (SpiderRating)

JSON output

GitHub Action

Basic usage

With outputs

Action inputs

Action outputs

Commands

Threat model

License

Available Tools

TDQS

TDQS

Tool Schema Changelog

TDQS

Maintenance

Resources

Looking for Admin?

Related MCP Connectors

Related MCP Servers

agent-audit

meok-mcp-injection-scan-mcp

mcp-heimdall

MCP Shield

Latest Blog Posts

MCP directory API