Alternatives
Products that do what Scan My MCP does
Audit MCPs for security vulnerabilities.
- 1MS
I noticed the growing security concerns around MCP (https://news.ycombinator.com/item?id=43600192) and built an open source tool that can detect several patterns of tool poisoning attacks, exfiltration channels and cross-origin manipulations. MCP-Shield scans your installed servers (Cursor, Claude Desktop, etc.) and shows what each tool is trying to do at the instruction level, beyond just the API surface. It catches hidden instructions that try to read sensitive files, shadow other tools' behavior, or exfiltrate data. Example of what it detects: - Hidden instructions…
2025 · github.com
- 2
- 3
- 4
- 5MF
Hey everyone, I've wanted an easy way to control which mcp server tools are available to clients. So for example, I might want a gmail server to only expose the read tool (but not send, delete etc). I figured if I create a cli for spawning mcp servers, I could intercept the stdin, stdout, stderr etc and modify what the clients see when they are making calls to list tools, resources, and prompts. Well it worked! In the initial version you can easily add a server to claude with a safe list of tools: npx -y mcpgod add @modelcontextprotocol/server-everything --client claude --tools=echo,add…
2025 · github.com
- 6
- 7MS
Hi HN! We kept seeing devs get pwned through MCP tools in ways that security scanners completely miss. So we built an open-source analyzer to catch these attacks. Our first OSS by Mighty team. The problem: At Defcon, we saw MCP exploits with 100% success rate against Claude and Llama. Three attack patterns: Hidden Unicode in "error messages" - Paste a colleague's error into Claude, your SSH keys get exfiltrated Trusted tool updates - That database tool you've used for months? Last week's update added credential theft Tool redefinition - Malicious tool redefines "deploy to prod" to run…
2025 · github.com
- 8MT
https://github.com/mcp-shark/mcp-shark Site: https://mcpshark.sh/ I built MCPShark, a traffic inspector for the Model Context Protocol (MCP). It sits between your editor/LLM client and MCP servers so you can: • See all MCP traffic (requests, responses, tools, resources) in one place • Debug sessions when tools don’t behave as expected • Optionally run “Smart Scan” checks to flag risky tools / configs
Dec 2025
- 9RA
Hi HN, We’re building security tooling around agentic AI systems. Today, we're releasing our public MCP catalog with detailed risk analysis for every MCP server we've found on the internet: https://mcp.armor1.ai/mcp-directory We all love agents and the power that MCPs unlock: suddenly your AI assistant can query databases, manage files, call APIs, and interact with the real world. But when we started adopting MCPs ourselves, we kept running into the same nagging questions: Is this MCP safe? Where is my data actually going? Could it execute destructive actions? Is it…
Feb 2026 · mcp.armor1.ai
- 10
- 11SS
Nov 2025 · smart.mcpshark.sh
- 12
- 13ST
Hi! After learning about MCP, I'm really excited about the future of provider-agnostic, re-usable tooling. Unfortunately I've found that while it's easy to implement an MCP server for use with tools that support it (such as Claude Desktop), it's not as easy to implement your own support (such as integrating an MCP server into your own LLM application). We implemented a thin MCP wrapper that easily integrates with Mirascope calls so that you can hook up an MCP server and client super easily to any supported LLM provider. Excited to see what people build with this!
2025 · mirascope.com
- 14
- 15
- 16MS
Hi HN, I've been building MCPSpec, an open-source CLI for MCP server reliability. Record sessions, generate mock servers, catch Tool Poisoning, and fail your CI build when something's wrong — without writing test code. There are ways to validate MCP servers today — the MCP Inspector, ad-hoc SDK scripts, unit tests for server internals — but nothing that handles regression detection, security auditing, mock generation, and CI pass/fail checks in one tool. MCPSpec does that: 1. Record a session against your real server, replay it after changes to catch regressions 2. Generate a standalone…
Feb 2026 · light-handle.github.io
- 17AM
Hi there, me and some friends were inspired by Simon Willison's recent post on the "lethal trifecta" (https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/ ) and started building a gateway to defend against it. The idea: instead of connecting an LLM directly to multiple MCP servers, you point them all through a Gateway. The Gateway: - Connects to each MCP server and inspects their tools + requirements - Classifies tools along the "trifecta" axes (private data access, untrusted content, external comms) - When all three conditions are about to align in a…
Sep 2025 · github.com
- 18
Inspect any remote MCP server — quality, cost, and security
22d ago · ytkoka.github.io
- 19
- 20MS
2025 · github.com
- 21
- 22MV
A few days ago I posted MCPShark (a traffic inspector for the Model Context Protocol). I just shipped a VS Code / Cursor extension that lets you view MCP traffic directly in the editor, so you’re not jumping between terminals, logs, and "I think this is what got sent". VS Code Marketplace: https://marketplace.visualstudio.com/items?itemName=MCPShark... Main repo: https://github.com/mcp-shark/mcp-shark Feature requests / issues: https://github.com/mcp-shark/mcp-shark/issues Site: https://mcpshark.sh/ If…
Dec 2025
- 23TF
Jan 2026 · mcp-workbench.ai
- 24
Ranked by how close each launch is in meaning, then by votes. Refine with a description →