Bawbel Scanner
Scan MCP server manifests and skill files for AVE-class vulnerabilities before you wire them into Claude Code or ship to users.
Overview
Bawbel Scanner is a MCP server for the Ship phase that scans MCP servers and skill files for AVE vulnerabilities before production.
What is this MCP server?
- Scans files or directories via stdio MCP with a configurable --path defaulting to the project root
- Detects AVE vulnerabilities using a catalog of 45 AVE records and Bawbel threat intel API
- Maps findings to OWASP MCP guidance for agent-tooling risk review
- PyPI package bawbel-scanner runnable with uvx for fast local and CI scans
- Targets both MCP server packages and standalone skill files in one pass
- 45 AVE records in publisher metadata
- OWASP MCP mapping enabled
- Threat intel API at https://api.piranha.bawbel.io
Community signal: 7 GitHub stars.
What problem does it solve?
Solo builders paste MCP servers and skills into agents without a fast way to catch known AVE-style risks in those packages.
Who is it for?
Indie developers curating multiple MCP servers and SKILL.md files who want a lightweight gate before updating agent configs or publishing tooling.
Skip if: Teams that only need application code SAST/DAST and do not install external MCP or skill packages.
What do I get? / Deliverables
You get structured vulnerability signals mapped to threat intel and OWASP MCP so you can block or fix risky integrations before they reach production agents.
- AVE-oriented findings for scanned MCP and skill paths
- OWASP MCP-aligned context for triage decisions
- Repeatable pre-ship scan you can script in CI
Recommended MCP Servers
Journey fit
How it compares
MCP-hosted supply-chain scanner, not an in-editor agent skill or generic cloud posture product.
Common Questions / FAQ
Who is Bawbel Scanner for?
It is for solo and small-team builders who install MCP servers and skills from registries and need a quick AVE-focused check before trusting them in Claude Code or similar agents.
When should I use Bawbel Scanner?
Use it when you add or upgrade an MCP server, vendor a skill file, or prepare a release where agent tooling touches production credentials or user data.
How do I add Bawbel Scanner to my agent?
Register the stdio MCP server from PyPI as bawbel-scanner (uvx runtime hint), pass --path to the file or directory to scan, and invoke scan tools from your MCP-capable client.