AgentsID Scanner

The Lighthouse of agent security.
Scan any MCP server. Get a security report card.

Your MCP server exposes tools to AI agents. How secure is it?

Most MCP servers ship with no authentication, no per-tool permissions, no input validation, and tool descriptions vulnerable to prompt injection. You just don't know it yet.

AgentsID Scanner tells you.

Quick Start

npx @agentsid/scanner -- npx @some/mcp-server

That's it. You get a letter grade and detailed findings.

What It Scans

The Report

╔══════════════════════════════════════════════════════════════╗
║          AgentsID Security Scanner — Report                  ║
╚══════════════════════════════════════════════════════════════╝

Server: my-mcp-server v1.0.0
Tools:  23
Scanned: 2026-03-29T12:00:00.000Z

Overall Grade: D (42/100)

Category Grades:
  injection       A
  permissions     F
  validation      D
  auth            F
  output          B

Tool Risk Profile:
  destructive          ████ 4
  execution            ██ 2
  credential_access    █ 1

Findings: 31
  CRITICAL: 2
  HIGH: 8
  MEDIUM: 15
  LOW: 6

Recommendations:
  1. Address CRITICAL and HIGH findings immediately
  2. Add per-tool permission controls (agentsid.dev/docs)
  3. Implement input validation on all tool parameters
  4. Add authentication to server endpoints

Usage

Scan a local MCP server (stdio)

# Scan any npx-installable MCP server
agentsid-scan -- npx @modelcontextprotocol/server-filesystem ./

# Scan a local server file
agentsid-scan -- node my-server.mjs

# Scan a Python MCP server
agentsid-scan -- python -m my_mcp_server

Scan a remote MCP server (HTTP)

agentsid-scan --url https://mcp.example.com/mcp

JSON output

agentsid-scan --json -- npx @some/mcp-server > report.json

Pass environment variables

agentsid-scan --env API_KEY=xxx --env DB_URL=postgres://... -- node server.mjs

Grading (v2 — normalized + capped)

Starts at 100 points. Deductions per finding:

MEDIUM and LOW findings are normalized by tool count so a per-tool issue (e.g. missing maxLength on every input) doesn't compound linearly with server size. A 50-tool server with 50 LOWs scores the same as a 5-tool server with 5 LOWs. CRITICALs and HIGHs stay absolute — real vulnerabilities hurt regardless of server size.

Injection Detection

The scanner checks tool descriptions for 11 prompt injection patterns:

• Instruction override — "ignore previous instructions", "disregard all rules"
• Role hijacking — "you are now a..."
• Memory wipe — "forget everything"
• Tool redirection — "instead of X, call Y"
• Hidden actions — "also execute..."
• Concealment — "do not tell the user"
• Stealth operations — "secretly", "covertly"
• Security bypass — "override auth", "skip validation"
• Encoded payloads — base64, eval(), template injections
• Unicode obfuscation — escaped characters hiding instructions

Risk Classification

Every tool is classified by name pattern:

Fix Your Grade

The scanner tells you what's wrong. Here's how to fix it:

Add per-tool permissions

npm install @agentsid/guard

AgentsID Guard validates every tool call against permission rules before execution. 50 tools, 16 categories, all protected.

Or add the SDK to your existing server

npm install @agentsid/sdk

Three lines of middleware in your MCP server. Full docs at agentsid.dev/docs.

Programmatic Usage

import { scanStdio, scanHttp, scanToolDefinitions } from "@agentsid/scanner";

// Scan a local server
const report = await scanStdio("npx @some/server", { json: true });

// Scan a remote server
const report = await scanHttp("https://mcp.example.com", { json: true });

// Scan tool definitions directly (no server needed)
const report = scanToolDefinitions(myToolArray, { json: true });

Contributing

Found a pattern we're not detecting? Open an issue or PR. The rule engine is in src/rules.mjs — adding a new pattern is one regex.

Research

• The State of MCP Server Security — 2026 — 15,983 servers scanned, 72.6% scored below 60
• Weaponized by Design — Toxic flow taxonomy, 5 attack patterns in production MCP servers
• The Multi-Agent Auth Gap — 4 structural gaps across 5 frameworks
• The A2A Security Gap — 6 structural vulnerabilities in Google's Agent2Agent protocol

All 15,982 servers scored and searchable: agentsid.dev/registry

Links

• AgentsID — Identity & auth for AI agents
• AgentsID Guard — 50-tool protected MCP server
• Documentation
• MCP Registry — 15,982 servers scored

License

MIT