Mcpshield
Scan MCP servers you are about to ship or install for tool poisoning and injection patterns before agents execute untrusted tool definitions.
Overview
mcpshield is a MCP server for the Ship phase that scans MCP servers for tool poisoning and injection as a security gate before you trust new integrations.
What is this MCP server?
- CLI MCP security scanner (mcpshield-cli on npm, v2.0.2)
- Detects tool poisoning and injection risks in MCP servers
- stdio MCP server packaging for agent-adjacent security workflows
- Open-source scanner repo at MCPShield-Dev/mcpshield for local runs
- Server and package version 2.0.2; npm identifier mcpshield-cli
- stdio transport; focuses on tool poisoning and injection per description
What problem does it solve?
Installing random MCP servers exposes your agent to malicious tool metadata and injection tricks that traditional app scans never flag for solo builders.
Who is it for?
Solo builders and small teams vetting third-party MCP servers during code review, launch prep, or whenever they add a new community integration.
Skip if: Organizations that need full SOC2 pen tests, runtime CSP for web apps only, or guaranteed coverage of every non-MCP supply-chain vector.
What do I get? / Deliverables
After you install mcpshield-cli and run scans, you get poisoning and injection findings you can fix or block before those MCP tools run in your agent config.
- Poisoning and injection findings for reviewed MCP servers
- Clearer go/no-go decisions before adding servers to agent configs
- Repeatable security step in your ship checklist for MCP integrations
Recommended MCP Servers
Journey fit
MCPShield belongs in Ship because it is a pre-deployment and pre-adoption security gate for MCP integrations, not market research or growth analytics. Security is the shelf for auditing third-party agent tools—aligns with detecting poisoning and injection in MCP server manifests and behaviors.
How it compares
MCP-specific security scanner CLI, not a generic npm audit and not a hosting firewall.
Common Questions / FAQ
Who is mcpshield for?
It is for developers and agent users who install MCP servers and want automated checks for tool poisoning and injection before trusting those tools.
When should I use mcpshield?
Use it in Ship-phase security whenever you add, upgrade, or fork an MCP server—especially community servers—before agents call new tools in production-like setups.
How do I add mcpshield to my agent?
Install mcpshield-cli from npm, configure it as a stdio MCP server or run the CLI directly per the GitHub repo, then scan target MCP server packages or configs before enabling them in Claude Code or Cursor.