SecureMCP

SecureMCP

**SecureMCP** is a comprehensive security auditing tool designed to detect vulnerabilities and misconfigurations in applications using the [Model Context Protocol (MCP)](https://modelcontextprotocol.io/introduction). It proactively identifies threats like OAuth token leakage, prompt injection vulnerabilities, rogue MCP servers, and tool poisoning attacks.

---

🛡️ Features

OAuth Token Scanner

• Token format validation and security checks
• Expiration and scope analysis
• Storage security assessment
• Token endpoint validation
• JWT token analysis

Prompt Injection Tester

• Multiple injection payload types
• Various injection positions testing
• Response analysis
• System prompt override detection
• Role confusion attack detection

Authentication & Server Integrity Check

• SSL/TLS configuration validation
• Authentication method testing
• Security header verification
• Server security assessment
• HSTS and CSP validation

Report Generation

• HTML and JSON report formats
• Vulnerability classification
• Severity assessment
• Remediation suggestions
• Summary statistics

---

👨‍💻 Who Should Use SecureMCP?

• AI Developers integrating MCP in applications
• Security teams securing AI model interactions
• DevSecOps engineers embedding MCP in CI/CD pipelines
• Researchers studying AI model vulnerabilities
• Security auditors assessing MCP implementations

---

🚀 Getting Started

Prerequisites

• Go 1.21+
• Docker (optional, for containerized deployment)
• Node.js (for dashboard UI)

Installation

From Source

git clone https://github.com/makalin/SecureMCP.git
cd SecureMCP
make build

Using Docker

docker pull makalin/SecureMCP

Basic Usage

Command Line

# Basic scan
./securemcp scan --target https://your-mcp-server.com

# Scan with specific options
./securemcp scan --target https://your-mcp-server.com \
    --scan-oauth \
    --scan-prompt-injection \

...