Mcpshield
- Updated April 13, 2026
- MCPShield-Dev/mcpshield
mcpshield is a MCP server that scans MCP servers for tool poisoning and injection as a security gate before you trust new integrations.
About
io.github.MCPShield-Dev/mcpshield is a security-focused Model Context Protocol offering that scans MCP servers for tool poisoning and injection—failure modes that matter when developers chain community servers into Claude Code or Cursor without a security team. Shipped as mcpshield-cli on npm with stdio transport, The catalog treats it as AppSec tooling for the MCP ecosystem, complementary to generic dependency scanners that do not understand tool descriptions and prompt injection surfaces. You still need human judgment on vendor trust and data handling; MCPShield narrows technical red flags in server definitions so you do not learn about a malicious tool only after an agent invoked it.
- CLI MCP security scanner (mcpshield-cli on npm, v2.0.2)
- Detects tool poisoning and injection risks in MCP servers
- stdio MCP server packaging for agent-adjacent security workflows
- Open-source scanner repo at MCPShield-Dev/mcpshield for local runs
Mcpshield by the numbers
- Data as of Jul 7, 2026 (Skillselion catalog sync)
claude mcp add mcpshield-cli -- npx -y mcpshield-cliAdd your badge
Show developers this MCP server is listed on Skillselion. Paste this into your README.
| Package | mcpshield-cli |
|---|---|
| Transport | STDIO |
| Auth | None |
| Last updated | April 13, 2026 |
| Repository | MCPShield-Dev/mcpshield ↗ |
What it does
Scan MCP servers you are about to ship or install for tool poisoning and injection patterns before agents execute untrusted tool definitions.
Who is it for?
Best when you're vetting third-party MCP servers during code review, launch prep, or whenever you add a new community integration.
Skip if: Organizations that need full SOC2 pen tests, runtime CSP for web apps only, or guaranteed coverage of every non-MCP supply-chain vector.
What you get
After you install mcpshield-cli and run scans, you get poisoning and injection findings you can fix or block before those MCP tools run in your agent config.
- Poisoning and injection findings for reviewed MCP servers
- Clearer go/no-go decisions before adding servers to agent configs
- Repeatable security step in your ship checklist for MCP integrations
By the numbers
- Server and package version 2.0.2; npm identifier mcpshield-cli
- stdio transport; focuses on tool poisoning and injection per description
README.md
MCPShield CLI
Scan MCP servers and GitHub repositories for security vulnerabilities.
Powered by MCPShield — the MCP security scanner with 59+ detection rules covering the OWASP MCP Top 10.
Install
npm install -g mcpshield
Setup
Get a free API key at mcpshield.co/settings, then:
mcpshield auth mcp_sk_your_key_here
Usage
# Scan an HTTP MCP server
mcpshield scan --url https://mcp-server.example.com/mcp
# Scan a GitHub repository
mcpshield scan --github https://github.com/user/repo
# JSON output (for CI/CD)
mcpshield scan --url https://mcp-server.example.com/mcp --json
# Filter by severity
mcpshield scan --url https://mcp-server.example.com/mcp --severity high
Exit Codes
0— Scan completed, no critical findings1— Error (invalid key, rate limit, scan failure)2— Scan completed with critical findings
Environment Variables
MCPSHIELD_API_KEY— API key (alternative tomcpshield auth)MCPSHIELD_API_URL— Custom API endpoint (for self-hosted)
License
MIT
Recommended MCP Servers
1Claw VaultHSM-backed vault secrets for AI agents (JIT fetch) plus prompt-injection and threat scanning.2
1passwordMCP server for 1Password service accounts — tools and resources for vaults and credentials18
402sentinel McpAssess an x402 counterparty's risk BEFORE paying: allow/review/block, scored on-chain (Base).1
A2adependencyinspector McpRemote MCP for A2A dependency inspector MCP, structured receipts, audit logs, and reviewer-ready evi
A2a Governance Bridge McpA2A Governance Bridge MCP server.A2aidentitytoll McpRemote MCP for A2A caller identity, scope policy, verdict receipts, and audit history.How it compares
MCP-specific security scanner CLI, not a generic npm audit and not a hosting firewall.
FAQ
Who is mcpshield for?
It is for developers and agent users who install MCP servers and want automated checks for tool poisoning and injection before trusting those tools.
When should I use mcpshield?
Use it in Ship-phase security whenever you add, upgrade, or fork an MCP server—especially community servers—before agents call new tools in production-like setups.
How do I add mcpshield to my agent?
Install mcpshield-cli from npm, configure it as a stdio MCP server or run the CLI directly per the GitHub repo, then scan target MCP server packages or configs before enabling them in Claude Code or Cursor.