Scan My MCP
Audit MCPs for security vulnerabilities.
Scan My MCP launched on May 25, 2026 with 5 votes, #2,008 of 20,538 launches that month and more than 75% of that year's launches.
What it does
MCP servers hand tools and prompts directly to LLM agents — most have never been audited. scan-my-mcp connects to any MCP server, enumerates everything it exposes, and runs 6 security checks: secret exposure, auth enforcement, dangerous permissions, input validation, prompt injection, and context-window cost. Every finding includes the exact location and a fix. Try it instantly at mcpscanner.yxsh.in or install CLI tool for local MCPs.
Audit Model Context Protocol servers for prompt injection, missing auth, unsafe permissions, and other tool-use risks.
MCP servers hand tools, resources, and prompts to LLM agents — each one a fresh attack surface. scan-my-mcp connects to a server, does a real handshake, enumerates everything it exposes, and runs six categories of static checks against the result. Opens a connection to your MCP server endpoint. Supports both Streamable HTTP and legacy SSE transports. Sends a standard MCP initialize request and captures the server name, version, protocol revision, and any declared capabilities. Calls tools/list, resources/list, and prompts/list to collect every definition the server exposes to an LLM agent. Runs six offline security checks against the collected definitions — secret exposure , auth…from mcpscanner.yxsh.in
Does a similar job
all alternatives →
MCP-Shield – Detect security issues in MCP servers2025 · github.com · ▲134I noticed the growing security concerns around MCP (https://news.ycombinator.com/item?id=43600192) and built an open source tool that can detect several patterns of tool poisoning attacks, exfiltration channels and cross-origin manipulations. MCP-Shield scans your installed servers (Cursor, Claude Desktop, etc.) and shows what each tool is trying to do at the instruction level, beyond just the API surface. It catches hidden instructions that try to read sensitive files, shadow other tools' behavior, or exfiltrate data. Example of what it detects: - Hidden instructions…
MCPSafeFeb 2026 · mcpsafe.org · ▲6We've been scanning MCP (Model Context Protocol) servers to understand the security posture of the ecosystem. After 306 servers and 1,211 vulnerabilities, here's what we found: - 69 critical vulnerabilities - 32 servers using eval() on untrusted input - 31 SQL injection vulnerabilities - 32 servers with hardcoded API credentials 10.5% of servers have at least one critical vulnerability. MCP servers run with your permissions. AI agents trust them implicitly. A prompt injection can exploit them remotely. MCPSafe (https://mcpsafe.org) lets you scan before you connect. Free tier…
MCP PlaygroundNov 2025 · mcpplayground.io · ▲160MCP Playground is a Postman-style tool for MCP — inspect servers, execute tools live, test your client, all from the browser. Four things in one place: 1. Free hosted MCP servers — four public test servers anyone can point their client at: Echo (connectivity), Auth (Bearer token flow), Error (error handling), Complex (multi-tool schemas).No sign-up, just use the URL. 2. Server inspector — paste any remote MCP server URL, see all its tools/resources/prompts, execute them live, inspect the full JSON-RPC log. HTTP, SSE, and WebSocket all supported. 3. Registry — 10,000+ servers…
Permit MCP GatewayMar 2026 · permit.io · ▲134Hi HN, Gabriel, Co-Founder at Permit.io. We're releasing Permit MCP Gateway today, an authorization proxy for MCP servers. TL;DR - we built an MCP Gateway that developers love and CISOs trust. Watch more[0] Now, after your little hate on using fancy copy on HN, to the real thing: MCP is in a strange place. Developers are debating whether it's overcomplicated compared to CLIs or skills files. Meanwhile, enterprises are adopting it by default because every agentic system that acts on your behalf, Cursor, Claude, Copilot, internal agents, needs a stable infrastructure for connecting to tools.…
MCPGod: Fine-grained control over MCP clients, servers, and tools2025 · github.com · ▲37Hey everyone, I've wanted an easy way to control which mcp server tools are available to clients. So for example, I might want a gmail server to only expose the read tool (but not send, delete etc). I figured if I create a cli for spawning mcp servers, I could intercept the stdin, stdout, stderr etc and modify what the clients see when they are making calls to list tools, resources, and prompts. Well it worked! In the initial version you can easily add a server to claude with a safe list of tools: npx -y mcpgod add @modelcontextprotocol/server-everything --client claude --tools=echo,add…
MCP Security Suite2025 · github.com · ▲36Hi HN! We kept seeing devs get pwned through MCP tools in ways that security scanners completely miss. So we built an open-source analyzer to catch these attacks. Our first OSS by Mighty team. The problem: At Defcon, we saw MCP exploits with 100% success rate against Claude and Llama. Three attack patterns: Hidden Unicode in "error messages" - Paste a colleague's error into Claude, your SSH keys get exfiltrated Trusted tool updates - That database tool you've used for months? Last week's update added credential theft Tool redefinition - Malicious tool redefines "deploy to prod" to run…
More dev tools this month
the category →
open-source IDE for thoughtful software design. Contribute to devdotfast/whiteboard development by creating an account on GitHub.
Dev tools · 27d ago · github.com
Contribute to reladraw/reladraw development by creating an account on GitHub.
Dev tools · 25d ago · github.com
OpenBot▲362Grok Bot alternative: free, local, open-source, multiplayer
Dev tools · 22d ago · openbot.run
Talanoa▲343Hi HN, I’m a fullstack developer, and honestly, I’ve lost count of how many side projects I’ve worked on over the years. But one idea kept coming back to me: a different kind of email client. It first came to me in 2014: “What if we could handle emails more like conversations?” Every year, I’d revisit this concept in my “Build Notes.” Ten years later, no one had built exactly what I had in mind — so I finally decided to do it myself. That’s how Talanoa was born. I wanted something focused on people, not timelines. I was tired of marking messages as unread just to remember to reply later, or…
Dev tools · 20d ago · talanoa.email
CoreSpeed▲332One MCP for everything your agents need: apps, memory, tools
Dev tools · 28d ago · corespeed.io
Source: Product Hunt launch ↗
Launched alongside, May 2026
the whole month →
Parallel agents, diff reviewer, and multi-model comparisons
Dev tools · May 2026 · kilo.ai
Hey HN, Henry here from Cactus. We open-sourced Needle, a 26M parameter function-calling (tool use) model. It runs at 6000 tok/s prefill and 1200 tok/s decode on consumer devices. We were always frustrated by the little effort made towards building agentic models that run on budget phones, so we conducted investigations that led to an observation: agentic experiences are built upon tool calling, and massive models are overkill for it. Tool calling is fundamentally retrieval-and-assembly (match query to tool name, extract argument values, emit JSON), not reasoning. Cross-attention…
Life & fun · May 2026 · github.com
🌱 Private, quiet space for thinking. Simple app for .md files. - zakirullin/files.md
Dev tools · May 2026 · github.com