MCP security tools: how to scan and protect Model Context Protocol servers

How MCP changes the attack surface

The Model Context Protocol lets an application expose tools to a language model, and the specification describes those tools as model-controlled: the model can discover and invoke them on its own. An MCP server can therefore be attacked as code and as text.

The specification’s security best practices page covers the code and authorization side: confused deputy proxies, token passthrough, server-side request forgery, local server compromise and over-broad scopes. Invariant Labs described the text side in a post dated April 1, 2025: tool poisoning, rug pulls and tool shadowing. The last column below is our analysis.

Risk	What it is	Where it is documented	Control that helps (our analysis)
Tool poisoning	Malicious instructions hidden in a tool description that the model reads and the user usually does not see	Invariant Labs post, April 1, 2025	Scanner before approval, and a client that shows the full description
Rug pull	A server changes a tool description after the client has approved it	Invariant Labs post, April 1, 2025	Gateway or wrapper that pins the approved configuration and blocks calls when it changes
Tool shadowing	One server’s description changes how the agent uses a trusted tool from another server	Invariant Labs post, April 1, 2025	Gateway rules over sequences of tool calls, and boundaries between servers
Local server compromise	A downloaded or configured local server runs commands with the client’s privileges	MCP specification, security best practices	Show the exact command before approval, and run the server in a sandbox
Token passthrough	A server accepts tokens that were not issued to it and forwards them downstream	MCP specification, security best practices	Server code that rejects every token not issued for it
Confused deputy	An MCP proxy with a static client ID lets a malicious client obtain an authorization code without the user’s consent	MCP specification, security best practices	Per-client consent in the proxy, a design fix that no scanner provides
Over-broad scopes	A stolen token with wildcard scopes exposes unrelated tools and data	MCP specification, security best practices	Minimal starting scopes, raised step by step

OWASP files the agent side under excessive agency, whose prevention list starts with minimizing the extensions an agent can reach and requiring user approval. Poisoned tool text behaves like prompt injection, and a malicious package behind a server is a supply chain problem. In our AI Security Layers model these tools sit in the agent and tool access layer, which limits what agents can reach; MCP scanners also count toward the model and supply chain layer.

How we picked

We include tools from our agent security category that document an MCP or agent tool control on a page we could open. We compile from public repositories and vendor pages and do not run the products, so nothing here measures detection quality. Every fact chip links its source and check date, and our methodology explains the Coverage Score.

Scanners: vet a server before you connect it

A scanner reads a server’s tool definitions, and in some products its code and packages, and reports risky patterns. Run it before approval and again on every update, because of the rug pull case above.

MCP-Scan, now published as Snyk Agent Scan, scans MCP servers, including their tools, prompts and resources Source, checked October 21, 2026: github.com · 2026-10-21 (opens in a new tab) , and it looks for tool poisoning and tool shadowing in MCP tool definitions Source, checked October 21, 2026: github.com · 2026-10-21 (opens in a new tab) . It also auto-discovers agent configurations for Claude Code, Cursor, VS Code, GitHub Copilot, Windsurf and Gemini CLI Source, checked October 21, 2026: github.com · 2026-10-21 (opens in a new tab) . On ownership, Snyk announced on June 24, 2025 that it has acquired Invariant Labs, the company that published MCP-Scan. Source, checked October 21, 2026: labs.snyk.io · 2026-10-21 (opens in a new tab) The scan calls Snyk’s API, so read the tool page before you run it on private configurations. Best for developers checking the MCP servers and skills in their coding agents.

Cisco MCP Scanner scans MCP server tools, prompts, resources and server instructions, on remote or stdio servers and from client config files Source, checked October 21, 2026: github.com · 2026-10-21 (opens in a new tab) . Its threat taxonomy lists tool poisoning and tool shadowing among the threats its analyzers detect Source, checked October 21, 2026: github.com · 2026-10-21 (opens in a new tab) . The tool page lists its offline mode for CI and the latest release October 20, 2026 Source, checked October 21, 2026: api.github.com · 2026-10-21 (opens in a new tab) . Best for security and platform teams that vet servers in CI before approval.

Agent skills are the newer attack path: a skill file and its scripts load straight into the agent. Cisco Skill Scanner scans agent skills for prompt injection, data exfiltration and malicious code patterns before they run Source, checked October 21, 2026: github.com · 2026-10-21 (opens in a new tab) , and an LLM analyzer reviews SKILL.md and scripts for semantic risks such as injected instructions, and needs an API key Source, checked October 21, 2026: github.com · 2026-10-21 (opens in a new tab) . Best for teams that let developers install agent skills and want a check in GitHub or a pre-commit hook.

Gateways and wrappers: enforce policy on live calls

A gateway or wrapper sits between client and server, so it can pin, block, mask, log or quarantine what passes. It only sees traffic routed through it, so block direct connections around it.

Lasso MCP Gateway acts as a proxy between an LLM agent and other MCP servers, intercepting requests and responses Source, checked October 21, 2026: github.com · 2026-10-21 (opens in a new tab) . Its scan option checks MCP server reputation and tool descriptions before loading and can block risky servers Source, checked October 21, 2026: github.com · 2026-10-21 (opens in a new tab) . Note that the lasso plugin sends content to Lasso's API to check for prompt injection, among other risks, and needs a Lasso API key Source, checked October 21, 2026: github.com · 2026-10-21 (opens in a new tab) . Best for developers who want one self-hosted gateway with swappable plugins.

mcp-context-protector runs as a wrapper between an MCP client and a downstream server, so it works with any MCP app Source, checked October 21, 2026: github.com · 2026-10-21 (opens in a new tab) . It pins an approved server configuration and blocks downstream tool calls when it changes until the user approves it again Source, checked October 21, 2026: github.com · 2026-10-21 (opens in a new tab) , and with a guardrail provider such as LlamaFirewall, scans tool responses for prompt injection and quarantines flagged ones Source, checked October 21, 2026: github.com · 2026-10-21 (opens in a new tab) . Best for developers running third-party servers in a desktop MCP client who want changes held until they approve them.

Invariant Guardrails evaluates rules on each LLM and MCP request, before and after, through the Invariant Gateway Source, checked October 21, 2026: github.com · 2026-10-21 (opens in a new tab) . It intercepts tool calls and applies rules to them, such as blocking an external email after an inbox is read Source, checked October 21, 2026: github.com · 2026-10-21 (opens in a new tab) . On ownership, Snyk announced on June 24, 2025 that it has acquired Invariant Labs, the company behind Invariant Guardrails. Source, checked October 21, 2026: labs.snyk.io · 2026-10-21 (opens in a new tab) Check maintenance first: the tool page shows the latest release July 28, 2025 Source, checked October 21, 2026: pypi.org · 2026-10-21 (opens in a new tab) . Best for teams that want to write their own rules over chains of tool calls.

Docker MCP Gateway acts as a central proxy between AI clients and MCP servers, starting a server when a tool is requested Source, checked October 21, 2026: docs.docker.com · 2026-10-21 (opens in a new tab) . It lets you choose which servers and tools a client can use, with the --servers and --tools options and per-profile tool lists Source, checked October 21, 2026: github.com · 2026-10-21 (opens in a new tab) , and its gateway options can block secret-like values in tool-call arguments and responses, and can block network access for tools Source, checked October 21, 2026: github.com · 2026-10-21 (opens in a new tab) . It logs tool calls and traces them; the call log records tool names and argument shape metadata, not raw argument values Source, checked October 21, 2026: github.com · 2026-10-21 (opens in a new tab) . Best for developers who already run Docker and want each MCP server in its own container behind one entry point.

IBM ContextForge federates MCP servers, A2A agents and REST or gRPC APIs behind one gateway endpoint Source, checked October 21, 2026: ibm.github.io · 2026-10-21 (opens in a new tab) . It documents role-based access control and authorizing tools in virtual servers, with JWT, OAuth and SSO sign-in Source, checked October 21, 2026: ibm.github.io · 2026-10-21 (opens in a new tab) , and it has a plugin framework with hooks before and after tool, prompt, resource, HTTP and agent calls, including a PII filter plugin Source, checked October 21, 2026: ibm.github.io · 2026-10-21 (opens in a new tab) . Best for platform teams that need one registry and endpoint for many MCP servers, A2A agents and APIs.

agentgateway connects agents to MCP servers through one gateway, with tool federation, OpenAPI integration and OAuth Source, checked October 21, 2026: github.com · 2026-10-21 (opens in a new tab) . Its tool page lists the MCP authorization rules, guardrail hooks and tool call logging it documents. Best for teams that want one open-source proxy for agent, MCP and LLM traffic.

Sandboxes: contain the server and the agent

The MCP specification says clients should run MCP server commands in a sandboxed environment with minimal default privileges, with restricted access to the file system, network and other system resources, using containers, chroot or application sandboxes. A sandbox limits what a compromised server can touch even after a scanner and a gateway miss it.

NVIDIA OpenShell runs each agent in an isolated sandbox, with Landlock limiting file access and seccomp limiting system calls Source, checked October 21, 2026: docs.nvidia.com · 2026-10-21 (opens in a new tab) . Its declarative YAML policies cover filesystem, process, network and provider credentials, and outbound traffic is allowed only to approved destinations Source, checked October 21, 2026: docs.nvidia.com · 2026-10-21 (opens in a new tab) , and it adds credentials only to requests bound for approved endpoints, so the agent never sees the real credential Source, checked October 21, 2026: github.com · 2026-10-21 (opens in a new tab) . Best for teams that want file, network and credential limits for each agent set in policy files.

Teams that host agent workloads on Kubernetes can compare Kubernetes Agent Sandbox, and our guide to securing AI agents covers Strands Box.

Detection and response: see what agents actually did

Scanners and gateways act on servers you know about. Detection tools look at the endpoint, find MCP servers and agents nobody registered, and record tool calls for investigation. In our model this is the monitoring and response band that runs across every layer.

Uber ADR discovery inventories AI apps, CLI agents, IDE extensions, local model runtimes and MCP servers on endpoints and flags unknown surfaces for review Source, checked October 21, 2026: github.com · 2026-10-21 (opens in a new tab) . Its sensor sensor collects user and assistant text, tool calls with arguments and results, and session context from 11 listed coding agents Source, checked October 21, 2026: github.com · 2026-10-21 (opens in a new tab) . Note how it exports: it exports session records as JSON files, or over OTLP/HTTP to an OpenTelemetry endpoint (off by default, with no redaction) Source, checked October 21, 2026: github.com · 2026-10-21 (opens in a new tab) . Best for security teams that want open-source visibility into coding agents on developer machines.

Cisco DefenseClaw scans skills and MCP servers before an agent loads them, wrapping Cisco's skill and MCP scanners; critical and high findings quarantine a skill by default Source, checked October 21, 2026: cisco-ai-defense.github.io · 2026-10-21 (opens in a new tab) . Its inspection engine checks LLM prompts, completions and tool invocations for injection attacks, data exfiltration and command-and-control patterns Source, checked October 21, 2026: blogs.cisco.com · 2026-10-21 (opens in a new tab) , and it records every decision in a local audit database and exports to OTLP, Splunk HEC, Prometheus and JSONL destinations Source, checked October 21, 2026: cisco-ai-defense.github.io · 2026-10-21 (opens in a new tab) . Best for teams that want scanning, inspection and logging for coding agents in one open-source layer.

Platforms: discovery, policy and monitoring from one vendor

These commercial platforms publish MCP features on their own pages and no prices. The claims are vendor statements, so ask each vendor to show the MCP features in each plan.

Operant AI offers an MCP Gateway for enterprise MCP security Source, checked October 21, 2026: operant.ai · 2026-10-21 (opens in a new tab) . It also applies registries, allow and deny lists and access controls to MCP Source, checked October 21, 2026: operant.ai · 2026-10-21 (opens in a new tab) . Best for platform teams running agents and MCP servers on Kubernetes.

Straiker checks MCP servers and tool connections against its own MCP Threat Database of local and remote MCP risks Source, checked October 21, 2026: straiker.ai · 2026-10-21 (opens in a new tab) . It also blocks or revokes risky MCP and tool access Source, checked October 21, 2026: straiker.ai · 2026-10-21 (opens in a new tab) . Best for teams that want discovery, adversarial testing and runtime blocking for MCP-connected agents from one vendor.

Pillar Security catalogs agents, models, tools, MCP servers and skills, including shadow AI Source, checked October 21, 2026: pillar.security · 2026-10-21 (opens in a new tab) . It also scans agent configurations, permissions and identities for excessive permissions Source, checked October 21, 2026: pillar.security · 2026-10-21 (opens in a new tab) . Best for security teams that want agent discovery and runtime guardrails with the option to keep data in their own VPC.

Limits

• Weak authorization in the server itself. Token passthrough, confused deputy flaws and over-broad scopes are fixed in server or proxy code, which the specification spells out. No scanner replaces those fixes.
• Approval screens that hide arguments. Invariant Labs reports that in its Cursor experiments the confirmation dialog showed only a summarized tool name, not the full tool input. Check what your client shows before you rely on approval.
• Wider agent risk. Over-powered tools and unchecked autonomy are covered in our guide to securing AI agents.

Deployment checklist

Items 2, 4, 5 and 7 follow the MCP specification’s security guidance; the rest is our analysis.

1. List every MCP server, skill and client in use, including ones developers added themselves. A detection tool on endpoints finds the ones nobody registered.
2. Treat each server as untrusted code. Show the exact command before a local server is approved, and run it in a sandbox with minimal privileges.
3. Scan before approval and on every update, then pin the approved configuration so a change needs a new approval.
4. Keep a human in the loop for sensitive operations, with tool inputs visible before the call.
5. Use least-privilege scopes, and accept only tokens issued for the server.
6. Route servers that need central policy through a gateway, and block connections around it.
7. Log tool usage and send it where your security team investigates incidents.
8. Attack the result. Our guide to open-source AI red teaming tools lists tools that probe agents and their tool use.

For prompt-level screening of the text that reaches the model, see prompt injection detection tools.