vulkro scan-mcp-server
Scans the source code of an MCP server for prompt-injection and tool-poisoning bugs. It reads Python (Anthropic SDK, FastMCP) and TypeScript / JavaScript (@modelcontextprotocol/sdk) servers.
vulkro scan-mcp-server src/
vulkro scan-mcp-server src/ --format sarif > mcp-server.sarif
Not to be confused with vulkro mcp-audit (checks MCP config files) or vulkro mcp serve (runs Vulkro as an MCP server).
Flags
| Flag | Description |
|---|---|
<PATH> | A source file or a project root. Required. |
-f, --format <FORMAT> | table (default), json, sarif, ndjson, junit, csv and others. |
--fail-on <SEVERITIES> | Severities that cause exit 1. Default critical,high. |
Rules
| ID | Fires when |
|---|---|
MCP-SERVER-001 | A tool description is built from non-literal input (description injection). |
MCP-SERVER-002 | A handler passes a caller-supplied path, URL, env name or command to a sink without validation (tool poisoning). |
MCP-SERVER-003 | tools/list returns descriptions computed at request time (rug-pull risk). |
MCP-SERVER-004 | A handler contains a subprocess call, eval, raw SQL or similar sink. Medium by default. |
MCP-SERVER-005 | The advertised inputSchema does not match the handler's parameters. |
MCP-SERVER-006 | The server is mounted at / or home, or fetches with no host allowlist. |
MCP-SERVER-007 | A handler returns secrets or sensitive values into the model's context. |
MCP-SERVER-008 | A destructive tool (delete, exec, transfer...) has no auth check. |
The detectors lean toward missing a case rather than flagging a well-built server. Run vulkro scan as well for the rest of the code.
Exit codes
0 no findings at or above --fail-on (or no MCP server files). 1 findings at or above --fail-on. 2 path not found, IO or parse error.