GitHub - kapilduraphe/mcp-watch: A comprehensive security scanner for Model Context Protocol (MCP) servers that detects vulnerabilities and security issues in your MCP server implementations. (original) (raw)

MCP Watch 🔍

A comprehensive security scanner for Model Context Protocol (MCP) servers that detects vulnerabilities and security issues in your MCP implementations.

Features

Installation

Global Installation

Local Installation

From Source

git clone https://github.com/yourusername/mcp-watch.git cd mcp-watch npm install npm run build

Usage

Command Line

Scan a GitHub repository

mcp-watch scan https://github.com/user/mcp-server

Scan with JSON output

mcp-watch scan https://github.com/user/mcp-server --format json

Filter by severity

mcp-watch scan https://github.com/user/mcp-server --severity high

Filter by category

mcp-watch scan https://github.com/user/mcp-server --category credential-leak

Note: If you don't want to download npm then just substitute mcp-watch with node dist/main.js.

Example: node dist/main.js scan https://github.com/user/repo

Options

Categories

Example Output

🔍 Scanning repository: https://github.com/user/mcp-server
📊 Based on vulnerablemcp.info, HiddenLayer, Invariant Labs, and Trail of Bits research

🔑 Scanning for credential vulnerabilities...
🧪 Scanning for tool poisoning vulnerabilities...
🎯 Scanning for parameter injection vulnerabilities...
💉 Scanning for prompt injection vulnerabilities...

📊 MCP SECURITY SCAN RESULTS
===============================

📈 Summary by Severity:
  🚨 CRITICAL: 2
  ⚠️ HIGH: 1
  ⚡ MEDIUM: 3

🔍 Detailed Results:
--------------------

1. 🚨 Hardcoded credentials detected
   📋 ID: HARDCODED_CREDENTIALS
   🎯 Severity: CRITICAL
   📂 Category: credential-leak
   📍 Location: src/config.ts:15
   🔍 Evidence: const apiKey = "sk-***REDACTED***"

Development

Project Structure

mcp-watch/
├── main.ts                          # CLI entry point
├── types/
│   └── Vulnerability.ts             # Type definitions
├── scanner/
│   ├── MCPScanner.ts               # Main scanner orchestrator
│   ├── BaseScanner.ts              # Base scanner utilities
│   └── scanners/                   # Individual vulnerability scanners
│       ├── CredentialScanner.ts
│       ├── ParameterInjectionScanner.ts
│       └── ...
└── utils/
    └── reportFormatter.ts          # Report formatting

Development Scripts

Build the project

npm run build

Run in development mode

npm run dev scan https://github.com/user/repo

Quick scan during development

npm run scan https://github.com/user/repo

Clean build artifacts

npm run clean

Adding New Scanners

  1. Create a new scanner in scanner/scanners/
  2. Extend AbstractScanner
  3. Implement the scan() method
  4. Add to MCPScanner.ts

Example:

import { AbstractScanner } from "../BaseScanner"; import { Vulnerability } from "../../types/Vulnerability";

export class MyScanner extends AbstractScanner { async scan(projectPath: string): Promise<Vulnerability[]> { console.log("🔍 Scanning for my vulnerability type...");

const vulnerabilities: Vulnerability[] = [];
// Your scanning logic here

return vulnerabilities;

} }

Security Research

This tool is based on security research from leading organizations in AI and cybersecurity, identifying novel attack vectors specific to MCP environments including:

Research Sources

Exit Codes

Contributing

  1. Fork the repository
  2. Create a feature branch
  3. Run type checking with npm run type-check
  4. Test your changes manually
  5. Submit a pull request

License

MIT License - see LICENSE file for details.

Support

⚠️ Security Notice: This tool identifies potential security issues but should not be the only security measure. Always perform manual security reviews and follow security best practices.