agent-security-scanner-mcp — Claude Code MCP server: what it does
Inspects AI-generated code for security flaws, flags hallucinated dependencies, and audits external MCP servers before your coding assistant runs them.
claude mcp add agent-security-scanner-mcp -- npx -y agent-security-scanner-mcpWhat agent-security-scanner-mcp does
This tool runs automated security checks on projects and assigns an overall letter grade from A to F. It inspects diffs and source files to catch SQL injection, exposed secrets, and command execution risks before code merges. The scanner also evaluates shell commands and filesystem actions ahead of execution.
It protects against supply chain threats. When language models invent dependency names, the scanner flags them to prevent dependency squatting attacks. It also audits third-party MCP endpoints for prompt poisoning, spoofed tool labels, and environment credential leaks.
Node.js and npx must be available locally. Without this runtime, the scanner commands will fail to execute.
What it helps with
- detect vulnerabilities and secrets in AI-generated pull request diffs
- audit external MCP tools for prompt poisoning and tool spoofing
- verify imported package names against registries to stop typosquatting
- generate CycloneDX SBOM records and check known CVEs via OSV.dev
Example prompts for the agent
- Run a security check on
./src/app.tsbefore staging changes. - Audit the MCP server located at
./tools/mcp-serverfor unsafe instructions. - Check
package.jsonfor hallucinated dependency names in the npm ecosystem.
How to install agent-security-scanner-mcp
Platform CLI
claude mcp add agent-security-scanner-mcp -- npx -y agent-security-scanner-mcpPlatform CLI
codex mcp add agent-security-scanner-mcp -- npx -y agent-security-scanner-mcpConfig file
{
"mcpServers": {
"agent-security-scanner-mcp": {
"command": "npx",
"args": [
"-y",
"agent-security-scanner-mcp"
]
}
}
}Config file
{
"servers": {
"agent-security-scanner-mcp": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"agent-security-scanner-mcp"
]
}
}
}Platform CLI
gemini mcp add agent-security-scanner-mcp npx -y agent-security-scanner-mcpStep by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about agent-security-scanner-mcp
How to install agent-security-scanner-mcp in Claude Code?
Run claude mcp add agent-security-scanner-mcp -- npx -y agent-security-scanner-mcp in your terminal. You can also configure it using npx agent-security-scanner-mcp init claude-code and restart the client.
What does agent-security-scanner-mcp do?
It equips coding agents with tools to scan diffs, verify package authenticity, check prompt inputs for injection, and audit MCP configurations.
How does the scanner catch hallucinated dependencies?
Commands like scan-packages inspect code imports and check whether those package names legitimately exist in registries like npm.
