Mcp Security Scanner

MCP Security Scanner

MCP server for scanning JavaScript/TypeScript projects for security vulnerabilities. Detects dangerous code patterns, insecure file permissions, risky dependencies, hardcoded credentials, and more.

Tools

Tool	Description
securityScan	Full recursive scan of a directory for all vulnerability types
scanFile	Scan a single JS/TS file for dangerous code patterns
auditDependencies	Check package.json for risky or unpinned dependencies
checkPermissions	Detect world-writable or overly permissive files
memoryStatus	Report scanner process memory usage

Detected Vulnerability Types

• Hardcoded credentials, API keys, and tokens (CRITICAL)
• eval(), new Function(), document.write usage (CRITICAL/HIGH)
• Command injection via child_process (CRITICAL/HIGH)
• XSS risks via innerHTML (HIGH)
• Insecure HTTP connections (MEDIUM)
• Dynamic require() (MEDIUM)
• Unpinned/wildcard dependencies (MEDIUM)
• Known risky npm packages (HIGH)
• World-writable file permissions (HIGH)
• Debug logging in production (LOW)

Quick Start

Install

npm install
npm run build

Run locally (stdio)

node dist/index.js

Run over network (Streamable HTTP)

MCP_TRANSPORT=http MCP_SERVER_HOST=0.0.0.0 MCP_SERVER_PORT=8100 node dist/index.js

Transport Notes

• stdio: default for local MCP clients.
• http: modern Streamable HTTP transport. Recommended for network access.

Environment Variables

Variable	Default	Description
MCP_TRANSPORT	stdio	Transport mode: stdio or http
MCP_SERVER_HOST	0.0.0.0	HTTP bind address
MCP_SERVER_PORT	8100	HTTP port
MCP_ALLOWED_ORIGINS	(none)	Comma-separated allowed Origins; returns 403 for others

Docker

# stdio mode (default)
docker build -t mcp-security-scanner .
docker run -it mcp-security-scanner

# HTTP m