mcp-gateway-scan
Read-only static scanner for MCP / agent-gateway production-readiness anti-patterns. Point it at a repo, get a 7-dimension red/yellow/green score in seconds.
Built by the team behind the Provenwright MCP Gateway Readiness Audit — a full cited audit with evidence index, scored gap matrix, and 90-day roadmap. Full audit: provenwright.com/audit
npx mcp-gateway-scan ./path/to/your/gatewayIt scans your code and config for the failure modes that turn an MCP gateway from a demo into an incident — authorization decided by the model, error handlers that fail open, unpinned supply chains, dark traces, unbounded spend, inline secrets, and missing operational levers — and prints exactly where each one lives.
100% read-only. It only reads files. It never executes your code, never makes network
calls, and never prints a secret value — for inline-secret hits it reports the location
only (<file:line>), with the value redacted.
Install
# one-off
npx mcp-gateway-scan <path>
# or global
pnpm add -g mcp-gateway-scan
mcp-gateway-scan <path>
