agent-security-scanner-mcp MCP工具

Before Adding A Dependency Suggested By AI

npx agent-security-scanner-mcp check-package express npm
npx agent-security-scanner-mcp scan-packages ./package.json npm --verbosity compact

Install In Your Agent

npx agent-security-scanner-mcp init claude-code

Then restart the client. Your agent can call the scanner as an MCP tool.

Before Installing An MCP Server

npx agent-security-scanner-mcp scan-mcp ./path/to/mcp-server --verbosity compact

Why Developers Install It

• One npx command gives an A-F security grade for AI-written code.
• MCP-specific checks catch risks that normal SAST tools miss.
• Package hallucination detection checks 4.3M+ package names across npm, PyPI, RubyGems, crates.io, pub.dev, CPAN, and raku.land.
• Output is compact by default so coding agents can read it without burning the context window.
• Works as a CLI, MCP server, GitHub Action workflow, Apify Actor, and semantic review agent.
• MIT licensed.

Screenshots

Demos

Run a safe local demo that creates intentionally vulnerable fixtures, scans them, and cleans them up.

```bash

MCP audit demo: tool poisoning, spoofed tool name, command execution, secret exposure

npx agent-security-scanner-mcp demo --type mcp --no-prompt

CLI Reference

All scanner outputs support context-friendly verbosity:

--verbosity minimal   # counts only, best for CI
--verbosity compact   # default, best for agents and humans
--verbosity full      # audit/debug detail

Apify Actor

Run the scanner as an Apify Actor when you want a hosted API or scheduled scans:

{
  "actorId": "folkloric_morale/agent-security-scanner",
  "input": {
    "target": "repository",
    "repoUrl": "https://github.com/your-org/your-agent.git",
    "repositoryScanMode": "quick",
    "includeTestFiles": false,
    "maxRepositoryFiles": 150,
    "severityThreshold": "medium"
  }
}

Package Hallucination Detection

Package hallucination demo: real imports mixed with fake AI-generated package names

npx agent-security-scanner-mcp demo --type packages --no-prompt

Expected demo shape:

Common Workflows

FAQ

Is this only for MCP servers? No. It scans normal repos, diffs, prompts, actions, packages, SBOMs, MCP servers, and AI skills.

Does it send my source code anywhere? Rule-based CLI and MCP scans are local. cr-agent uses the provider you choose for semantic review.

Is it a replacement for npm audit? No. It complements npm audit by catching AI-specific risks: hallucinated packages, prompt injection, MCP tool poisoning, unsafe agent actions, and vulnerable generated code.

What should I run first? Run npx agent-security-scanner-mcp scan-project . --verbosity compact.