mcp-watch - A comprehensive security scanner for Model Context

项目说明

MCP Watch 🔍

A comprehensi scanner for Model Context Protocol (MCP) servers that detects and security issues in your MCP implementations.

Features

🔑 Credential Detection - Finds hardcoded API keys, tokens, and insecure credential storage

🧪 Tool Poisoning - Detects hidden malicious instructions in tool descriptions

🎯 Parameter Injection - Identifies magic parameters that extract sensitive AI context

💉 Prompt Injection - Scans for prompt manipulation and injection attacks

🔄 Tool Mutation - Detects dynamic tool changes and rug-pull risks

💬 Con Exfiltration - Finds triggers that steal con history

🎨 ANSI Injection - Detects steganographic attacks using escape sequences

📋 Protocol - Identifies MCP protocol security

🛡️ Input - Finds command injection, SSRF, and path tra issues

🎭 Ser - Detects servers impersonating popular services

🌊 Toxic Flows - Identifies dangerous data flow patterns

🔐 Permission Issues - Finds excessi and access control problems

Quick Start 🚀

Option 1: NPM Package (Recommended)

Option 2: From GitHub Source

Option 3: Docker (No Installation)

Installation

Global Installation

Local Installation

From Source

Docker Installation 🐳

#### Quick Start with Docker

#### Docker Compose (Recommended for Production)

#### Docker Features

🔒 Security: Non-root user, minimal attack surface

📦 Optimized: Multi-stage builds, Alpine Linux base

🚀 Production: Ready for deployment and CI/CD

🧹 Simplified: Single optimized Dockerfile for all use cases

Usage

Command Line

#### Scan GitHub Repositories

#### Scan Local Projects

Installation Method Usage

#### From NPM Package

#### From GitHub Source

Docker Usage 🐳

Options

--format <type> - Output format: console (default) or json

--se <level> - Minimum se: low, medium, high, critical

--category <cat> - Filter by category

Categories

credential-leak - Hardcoded credentials and insecure storage

tool-poisoning - Malicious tool descriptions

data-exfiltration - Data theft and parameter injection

prompt-injection - Prompt manipulation attacks

tool-mutation - Dynamic tool changes

steganographic-attack - Hidden content in escape sequences

protocol- - MCP protocol security issues

input- - Command injection, SSRF, path tra

ser - Ser

toxic-flow - Dangerous data flows

access-control - Permission and access issues

Example Output

De

Project Structure

De Scripts

De Workflow 🚀

#### Local De (Recommended)

#### Docker De 🐳

Adding New Scanners

1. Create a new scanner in scanner/scanners/
2. Extend AbstractScanner
3. Implement the scan() method
4. Add to MCPScanner.ts

Example:

Security Research

This tool is based on security research from leading organizations in AI and cybersecurity, identifying no specific to MCP en including:

Parameter injection attacks that extract sensitive AI context

Tool poisoning with hidden malicious instructions

Con exfiltration using trigger phrases

Steganographic attacks via ANSI escape sequences

Toxic agent flows across repository boundaries

Research Sources

Database (.info)

- Comprehensi of MCP
- Real-world attack patterns and examples
- Regular updates on new attack

HiddenLayer Research (Exploiting MCP Tool Parameters)

- Parameter injection attacks that extract sensitive data
- Tool call history and con exfiltration
- System prompt extraction
- Chain of thought manipulation
- Model name disclosure risks

In Labs Research (GitHub MCP )

- Tool poisoning detection
- Toxic agent flows
- Cross-repository security issues
- Rug-pull updates in tool functionality
- Ser pre

Trail of Bits Research (MCP Security Research)

- Con exfiltration methods
- ANSI injection attacks
- Protocol-le
- Insecure credential storage patterns
- Cross-ser attacks

PromptHub Analysis (5 MCP Security )

- Command injection patterns (43% of public MCP servers affected)
- SSRF statistics (30% allow arbitrary URL fetching)
- Path tra attack (22% leak files outside intended directories)
- Retrie Deception (RADE) attacks
- Tool poisoning pre strategies

Exit Codes

0 - No critical or high se found

1 - Critical or high se detected

1 - Scan error occurred

Contributing

1. Fork the repository
2. Create a feature branch
3. Run type checking with npm run type-check
4. Test your changes manually
5. Submit a pull request

GitHub Actions 🚀

This repository uses automated workflows for CI/CD, security scanning, and dependency management:

CI: Automated testing and Docker on every push/PR

Security Scan: Daily security audits and checks

Dependency Update: Weekly dependency maintenance and security fixes

Release: Automated release asset creation

Docker Test: Docker-specific testing and

Dependabot 🤖

Automated dependency management with:

npm: Weekly updates with auto-merge for minor/patch

GitHub Actions: Automated action updates

Docker: Base image updates

See GITHUB_ACTIONS.md for detailed workflow documentation.

Docker De Workflow 🐳

License

MIT License - see LICENSE file for details.

Support

Create an issue for bug reports or feature requests

Check existing issues before creating new ones

Include scan output and repository details when reporting issues

Docker Support 🐳

Documentation: See DOCKER.md for detailed Docker usage

Issues: Include Docker and Docker Compose when reporting issues

Testing: Test with both production and de containers

---

⚠️ Security Notice: This tool identifies potential security issues but should not be the only security measure. Always perform manual security reviews and follow security best practices.

项目信息

开发语言：TypeScript

Star 数：136

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕A comprehensive security scanner for Model Context Protocol (MCP) servers that detects vulnerabilities and security issues in your MCP server implementations.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。