mcp-scrutiny

Offline security scanner for MCP tool definitions. Five detectors — unpinned packages, rug pulls, tool poisoning, cross-server shadowing and toxic flows — plus a 31-feature trained model for the cases keyword rules miss. Zero third-party dependencies, so nothing leaves the machine: MCP tool descriptions name internal systems, endpoints and team vocabulary, and uploading them to a vendor is a disclosure the user did not intend. Installs from PyPI with pip install mcp-scrutiny. It has already been used for the first security audit of the MCP servers that move money across Francophone Africa — CinetPay, Deggo, Orange Money and MTN MoMo, all of which are listed in this registry. Seven servers across a dozen countries, five findings, and every one disclosed to the maintainers before publication: https://github.com/bryand410/mcp-scrutiny/blob/main/docs/2026-10-francophone-mobile-money-mcp-security.md Apache-2.0. 127 tests. Python 3.11+. Documentation: https://pypi.org/project/mcp-scrutiny/

Category

Developer Tools

Pricing

Not listed

Country

🇨🇲 Cameroon

Last verified

Not recorded

{
  "name": "mcp-scrutiny",
  "slug": "mcp-scrutiny",
  "category": "TOOL",
  "country": "CM",
  "docs_status": "LIVE",
  "licensing_required": "NONE",
  "verified": false,
  "last_verified": null,
  "website": "https://github.com/bryand410/mcp-scrutiny",
  "documentation_url": null
}