ramparts - MCP & SKILL scanner that scans any mcp server or s

项目说明

<di="center">

Ramparts: security scanner for MCP servers and AI agent skills

<img src="assets/ramparts.png" alt="Ramparts Banner" width="250" />

*A fast, lightweight security scanner for the agent stack — Model Context Protocol (MCP) servers AND AI agent skills (Claude Code commands, agentskills.io bundles, Cursor / Codex / Windsurf / Gemini equi) — with built-in detection.*

![Crates.io]()
![GitHub stars]()
![Rust]()
![Tests]()
![Clippy]()
![Release]()

</div>

O

Ramparts scans the two surfaces an AI agent trusts most: the MCP servers it talks to over the network, and the skill files it loads from disk and executes by name. Both deli instructions and tool grants into the agent's loop; ramparts applies the same security pipeline (YARA, LLM analysis, OWASP MCP Top 10 tagging) to both.

MCP scanning covers the Model Context Protocol — the open standard that lets AI assistants connect to databases, file systems, and APIs . Ramparts discovers a server's tools/resources/prompts and audits them for prompt injection, tool poisoning, secret leakage, path tra, command injection, cross-origin escalation, supply-chain CVEs (via OSV.dev), and more.

Skill scanning covers the markdown/YAML files an agent loads as named capabilities — Claude Code custom slash commands, Cursor / Codex / Windsurf / Gemini equi, and first-class support for agentskills.io bundles (<name>/SKILL.md directories with sibling scripts/, references/, assets/). Each skill body becomes a synthetic MCP prompt that runs through the same analyzers; bundled scripts get scanned through YARA, name- mismatches surface as HIGH-se deception findings, and the agentskills.io name/charset rules are .

Ramparts is under acti. Read our launch blog.

The Security Challenge

The MCP-and-skills attack surface is broad. MCP servers expose file systems, databases, APIs, and system commands — turning into attack via tool poisoning, command injection, and data exfiltration without proper analysis. Agent skills carry the same risk profile (untrusted instructions an agent may follow) plus their own twists: skill-file allowed-tools grants that hand out unrestricted Bash, sensitive @<path> references that inline credentials into prompt context, name collisions that let one skill shadow another in the agent's router, and bundled scripts that ship arbitrary executable code. 📚 Security Features & Attack documents every detector ramparts ships with — across both MCP and skill scanning.

What Ramparts Does

Ramparts provides security scanning of the MCP-and-skill ecosystem by:

1. MCP ser & analysis — scans MCP endpoints for tools/resources/prompts; multi-transport (HTTP, SSE, stdio, subprocess) with intelligent fallback and session management
2. Skill scanning — same threat model applied to agent skill files on disk (Claude Code commands, agentskills.io bundles incl. bundled scripts/ + references/, Cursor / Codex / Windsurf / Gemini )
3. Static analysis (YARA) — 40 pre-scan rules across both surfaces: 10 skill-targeted rules (prompt-injection , credential har, tool-chaining exfil, system manipulation, authority abuse, covert exfiltration) plus malware-IOC rules adapted from NVIDIA SkillSpector (cryptominers, reverse shells / C2 / info-stealers, webshells, offensive hack tools)
4. E rescan — every YARA rule is also run over a normalized view (in/zero-width chars stripped, NFKC homoglyph folding) and iteratively base64/hex-decoded views, so a keyword split by zero-width characters, spelled in fullwidth homoglyphs, or hidden in an encoded blob still matches
5. LLM-powered analysis — sophisticated semantic issues no static rule can spot (tool descriptions that lie about behavior, sneaky permission requests, etc.)
6. Cross-origin analysis — detects tools spanning multiple domains, a context-hijacking / injection
7. Supply-chain co — queries OSV.dev for known CVEs in npx/u stdio MCP servers and in exactly-pinned dependencies declared by skill bundles (requirements.txt, package.json)
8. Rug-pull / drift detection — content-fingerprints MCP ser, indi tool definitions, and skill files against a stored baseline; flags any post-approval swap (MCPConfigChanged / MCPToolChanged / SkillContentChanged)
9. Structural skill heuristics — o allowed-tools grants, vague/generic triggers, sensitive @<path> references, embedded base64/hex payloads, skill-name collisions, agent identity/memory-file writes, undeclared network egress (manifest- mismatch), external-reference in, unsafe-YAML-deserialization tags, brand impersonation, JSON prototype pollution, and an explicit incomplete-co finding when files are skipped
10. agentskills.io spec — directory-vs-name: mismatch (deception), spec name-rule , unknown frontmatter fields
11. OWASP taxonomy tagging — every finding mapped to the OWASP MCP Top 10; skill-surface findings additionally carry OWASP Agentic Skills Top 10 (AST01–AST10) tags. in terminal, JSON, SARIF, and markdown report output
12. Multiple output formats — terminal, JSON, SARIF 2.1.0 (for GitHub Ad Security / GitLab / Azure DevOps), and a detailed markdown report
>
> 💡 Jump directly to detailed Rampart features?
> 📚 Detailed Features

Who Ramparts is For

MCP users — scan third-party MCP servers before connecting; local servers before production

MCP de — ensure your tools/resources/prompts don't expose to AI agents

Skill authors — agentskills.io bundles against the spec before publishing; catch o tool grants and sensiti references in your .claude/commands/ or bundled scripts/

Agent operators — scan the skills your team has authored or installed; check that no bundle has been swapped under a decepti name; surface findings in your existing SARIF/code-scanning workflow

Use Cases

Security audits — full assessment of an MCP server's posture or a skill repo's safety

De — fast feedback loop while building MCP servers or authoring skills

CI/CD integration — gate PRs that add skills or change MCP ser (SARIF flows directly into GitHub code-scanning, GitLab, Azure DevOps)

Compliance — meet AI-agent deployment security requirements with OWASP MCP Top 10-tagged e

> 💡 Caution: Ramparts analyzes static metadata, configurations, and skill files. For comprehensi, combine with runtime MCP guardrails and adopt a layered security approach. The MCP+skills threat landscape is rapidly e, and ramparts is not perfect — inaccuracies are ine.

Quick Start

Installation

Ramparts has two top-level scan surfaces. Pick whichever (or both) match what
you're securing.

1. Scan MCP servers

2. Scan AI agent skills

Skill formats supported out of the box:

Claude Code custom slash commands — flat .md files under

.claude/commands/ (per-user and per-workspace)

agentskills.io bundles —

<name>/SKILL.md directories with optional sibling scripts/ (.py / .sh
/ .bash / .zsh / .js / .mjs / .cjs / .ts / .rb / .pl / .ps1),
references/ (.md), and assets/. Bundle mode also the spec's
name: field against the parent directory name, the 1–64 char
[a-z0-9-] rule, and surfaces name- mismatches as
HIGH-se deception findings (AgentskillsNameMismatch).

Cursor / OpenAI Codex / Windsurf / Gemini skill repos that ship the same

markdown + YAML frontmatter shape — supported frontmatter fields
and the per-ecosystem dotdir discovery roots.

> 💡 Did you know you can start Ramparts as a server? Run ramparts server to get a REST API for continuous monitoring and CI/CD integration. See 📚 Ramparts Server Mode

Run as an MCP server (stdio)

When publishing to Docker MCP Toolkit, configure the container command to ramparts mcp-stdio so the toolkit connects . Use MCP-Dockerfile to make this the default.

Example Output

Single server scan:

IDE configuration scan:

Skill scan (agentskills.io bundle):

(AgentskillsNameMismatch is from agentskills.io spec ; the
SecretsLeakage / SSHKeyExposure rows are bundled-script YARA findings —
ramparts walked scripts/exfil.py and references/api.md automatically.)

Contributing

We welcome contributions to Ramparts. If you ha, bug reports, or feature requests, please open an issue on our GitHub repository.

Documentation

📖 CLI Reference — All commands (scan, scan-config, skills scan, skills scan-config, replay, server, mcp-stdio), options, and usage examples

🛡️ Security Features & Attack — Every detector ramparts ships with, across MCP + skill scanning

⚙️ Configuration Reference — Complete config file documentation + skill discovery root config

🔍 Troubleshooting Guide — Solutions to common issues

📚 Detailed Features — How each capability works under the hood

Additional Resources

Need Support?

MCP Protocol Documentation

// Examples folder was removed to reduce branch diff; see configuration docs instead.

Configuration Guide

项目信息

开发语言：Rust

Star 数：98

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕MCP & SKILL scanner that scans any mcp server or skills for indirect attack vectors and security or configuration vulnerabilities. Aligned with OWASP SKILL Top 10 and OWASP MCP Top 10 threats & vulnerabilities. 展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。