Bawbel Scanner
Scan MCP servers and agent skill files for Agentic Vulnerability Enumeration (AVE) issues before you ship or publish tooling.
Overview
io.github.bawbel/bawbel-mcp is a MCP server for the Ship phase that scans MCP servers and skill files for AVE vulnerabilities with conformance scoring and threat intel.
What is this MCP server?
- Bawbel Scanner MCP (PyPI bawbel-mcp v1.1.0, uvx runtime hint)
- Scans MCP servers and skill files for AVE vulnerabilities
- Conformance scoring plus threat intelligence integration
- stdio transport for security workflows inside the agent
- Server version 1.1.0
- PyPI identifier bawbel-mcp with uvx runtime hint
- Publisher categories include security, devsecops, scanner, vulnerability
Community signal: 1 GitHub stars.
What problem does it solve?
Community MCP servers and skills can carry agentic vulnerabilities you will not catch with ordinary app linting.
Who is it for?
Indie builders who install many MCP servers or distribute skills and want agent-driven security scans in the Ship hardening loop.
Skip if: Teams that only need traditional SAST on application code with no MCP or SKILL.md surface area.
What do I get? / Deliverables
You get AVE-focused scan results and conformance signals before trusting tooling in production agent configs.
- AVE vulnerability findings for MCP and skill targets
- Conformance scoring output for reviewed artifacts
- Threat-intel-informed scan context via Bawbel tooling
Recommended MCP Servers
Journey fit
How it compares
AVE-focused MCP and skill scanner, not a general cloud posture or dependency-only SCA tool.
Common Questions / FAQ
Who is bawbel-mcp for?
Solo developers and small teams shipping Claude Code or Cursor workflows who need to vet MCP servers and skill files for agentic vulnerabilities.
When should I use bawbel-mcp?
Use it before adding unknown MCP packages to your config, before publishing skills, and after meaningful upgrades to agent tooling.
How do I add bawbel-mcp to my agent?
Run via uvx/PyPI identifier bawbel-mcp with stdio transport in your MCP client, following github.com/bawbel/bawbel-mcp setup for paths and scan targets.