AgentsID Scanner

The Lighthouse of agent security.
Scan any MCP server. Get a security report card.

---

Your MCP server exposes tools to AI agents. How secure is it?

Most MCP servers ship with no authentication, no per-tool permissions, no input validation, and tool descriptions vulnerable to prompt injection. **You just don't know it yet.**

AgentsID Scanner tells you.

Quick Start

npx @agentsid/scanner -- npx @some/mcp-server

That's it. You get a letter grade and detailed findings.

What It Scans

Category	What It Checks	Why It Matters
Injection	Tool descriptions for 11 prompt injection patterns	Malicious tool descriptions can hijack agent behavior
Permissions	Tool names classified by risk (destructive, execution, financial, credential)	50 tools with no access control is a 50-surface attack
Validation	Input schemas for missing constraints, unbounded strings, optional-only params	No validation = arbitrary input to your tool handlers
Auth	Authentication indicators in tool surface	No auth tools = unauthenticated agents calling your tools
Secrets	Tools that may expose credentials in output	API keys, tokens, passwords leaked in responses
Output	Unfiltered file/data output	Sensitive file contents returned without redaction

The Report

╔══════════════════════════════════════════════════════════════╗
║          AgentsID Security Scanner — Report                  ║
╚═════════════════