$ show cisco-ai-defense/mcp-scanner
This is a comprehensive security scanning tool for MCP (Model Context Protocol) servers, developed by Cisco AI Defense. It supports scanning tools, prompts, resources, and server instructions for vulnerabilities, malicious behavior, and operational readiness. The scanner uses a multi-engine architecture combining YARA rules, LLM-based semantic analysis, static dataflow/taint analysis (Python, JS/TS, Go, Java, etc.), behavioral alignment verification, VirusTotal hash lookups, and pip-audit vulnerability scanning. It can scan remote servers (SSE/HTTP), local stdio servers, static JSON files, and packages from PyPI or npm (sandboxed via Docker). The system provides a CLI tool (`mcp-scanner`), a FastAPI HTTP server (`mcp-scanner-api`), and a Python SDK for programmatic use. It also includes a Claude Code plugin for in-IDE scanning. The codebase exhibits strong engineering practices with modular analyzers, dependency injection, structured logging, and extensive test coverage. However, it has some technical drift risks due to heavy reliance on external LLM APIs, pinned LiteLLM version, and duplication in cross-file analysis modules.
The LLM identified 6 files worth highlighting for reuse:
Defines the `BaseAnalyzer` abstract base class and `SecurityFinding` dataclass. `BaseAnalyzer` standardizes the analyzer interface with `analyze()` method, MCP taxonomy enrichment via `ThreatMapping`, and structured logging. `SecurityFinding` provides a consistent shape for all findings across different analyzer types. This pattern allows easy addition of new analyzers by subclassing, making the scanner extensible and maintainable.
Implements `safe_resolve_path` and `resolve_base_dir` to prevent symlink-based directory traversal attacks. Uses `os.path.realpath` and strict base directory verification with recursive symlink resolution. Can be extracted and reused in any Python project that needs to safely walk or access user-supplied file paths without escaping a sandboxed directory.
Provides secure download and extraction of untrusted package archives (tar.gz, zip) with byte caps, path traversal prevention, digest verification, and HTTPS enforcement. Includes `safe_extract_tar_gz`, `safe_extract_zip`, and `download_archive` functions with configurable size limits. Demonstrates a well-engineered pattern for safely handling third-party package files in CI/CD or scanning pipelines.
Implements a generic worklist-based forward dataflow analysis algorithm over a control-flow graph. Used for reaching definitions, available expressions, constant propagation, and liveness analysis. The abstract `DataFlowAnalyzer` class with `analyze_node`, `merge` functions and lattice operations is reusable for building custom static analyzers for any language with a CFG.
Encapsulates Open Policy Agent (OPA) binary invocation for evaluating Rego policies on tool definitions. Includes graceful fallback when OPA is not installed, returning a neutral score. The `OpaProvider` class with `check_ready` method is a clean, reusable pattern for integrating OPA as an optional evaluation engine with minimal dependency coupling.
A simple dependency injection container (`DIContainer`) that registers and resolves named services. Supports lazy instantiation, singleton/transient scopes, and clear separation of concerns. Lightweight enough to extract and use in small to medium Python applications without pulling in a full framework.