AppRisingofficial publisher

Cisco mcp-scanner

App : A product you use directly

Open source scanner by Cisco based on YARA to analyze MCP tool descriptions and schemas.

A second opinion alongside mcp-scan, with no data sent to a third-party API.

GitHub · 1,097 ★

Overall score

8.7 /10

Security: nothing to flag

Utility

7.5

Reliability

10.0

Security

No caveat on record

Ease

5 min · Technical

Security reflects where data goes, requested permissions and incidents on record at the verification date. It is not a guarantee of zero risk: check the deployment mode and the connections you enable.

What it does, concretely

MCP (Model Context Protocol) servers expose tools that AI agents can call directly. Without prior verification, a malicious server can inject hidden instructions into tool descriptions or schemas, manipulating an agent's behavior without the user's knowledge.

Cisco mcp-scanner analyzes these descriptions, schemas, prompts, and resources using three combinable engines: YARA rules for known pattern detection, LLM-based analysis for subtler threats, and the Cisco AI Defense API for deeper inspection. The tool can connect to a remote MCP server, launch a local stdio server, read existing configuration files, or analyze JSON files offline in CI/CD mode. It can also scan Python dependencies for known vulnerabilities, analyze MCP server source code, and check binary files via VirusTotal.

The tool is aimed at developers, security teams, and administrators who deploy or evaluate MCP servers in professional environments. It can be integrated into a CI/CD pipeline thanks to its offline mode and configurable output format.

It is less suited to users looking for a graphical interface or a solution without a command line. The YARA engine works without an API key, but the LLM and Cisco AI Defense engines require third-party keys to be activated.

What it offers

·Analysis of MCP server tools, prompts, resources, and instructions using three engines: YARA, LLM, and Cisco AI Defense API.
·Offline scanning of pre-generated JSON files, suited for CI/CD pipelines and air-gapped environments.
·Detection of vulnerabilities in Python dependencies via pip-audit integration (CVE, PYSEC, GHSA).
·Behavioral source code analysis of MCP servers to identify threats in the code.
·Binary file verification (images, PDFs, executables, archives) via SHA256 hash lookup on VirusTotal.
·PyPI and npm package scanning inside a Docker sandbox with behavioral analysis.
·Exposure as a REST API server for integration into other tools.
·Customizable YARA rules to adapt detection to specific contexts.

Our tips

For a first use without an API key, run the YARA engine alone with --analyzers yara: no data is sent to a third-party service.
Always place global options (such as --analyzers or --format) before the subcommand, otherwise they are ignored.
In CI/CD, use the static subcommand with pre-generated JSON files and --log-level error to surface only alerts.
If a stdio server takes time to start (heavy dependencies on first launch), increase the timeout with --stdio-timeout 180 or the MCP_SCANNER_STDIO_TIMEOUT environment variable.
To use a local LLM (Ollama, vLLM), set MCP_SCANNER_LLM_API_KEY to any value and point MCP_SCANNER_LLM_ENDPOINT to your local instance.

Watch out

The LLM and Cisco AI Defense engines require third-party API keys; without them, only the YARA engine is available, which may miss more sophisticated threats.
Scanning PyPI and npm packages in Docker mode requires Docker to be installed and accessible on the machine; without Docker, the --no-docker option must be used, which runs the analysis in the current process.

In practice

Price: Free
Commercial use: Commercial use: yes
Available on: cli
Licence: Apache-2.0

Security and data

Rating: Security: nothing to flag
Your data: Data stays local
Maintenance: Active
Last release: 20 October 2026

Links and repository checked on 25 October 2026 · added on 1 August 2025

How to install Cisco mcp-scanner

1. Verify that Python 3.11 or higher is installed on your machine. 2. Install the uv package manager if not already done. 3. Install the tool with the command: uv tool install --python 3.13 cisco-ai-mcp-scanner 4. For the YARA engine only (no API key needed), run directly: mcp-scanner --analyzers yara --format summary --server-url <url> 5. To enable the LLM or Cisco AI Defense engines, set the corresponding environment variables (MCP_SCANNER_API_KEY, MCP_SCANNER_LLM_API_KEY) before running the scan. 6. Never share your API keys in versioned files; use environment variables or a secrets manager.

uv tool install --python 3.13 cisco-ai-mcp-scanner

In the same category

Whole category Monitor →