Under maintenance

Pricing

Pay per usage

Try for free

Go to Apify Store

Mcp Server Security Scanner

Under maintenance

Try for free

Pricing

Pay per usage

Rating

0.0

(0)

Developer

Mihai Sijarvis

Actor stats

Bookmarked

Total users

Monthly active users

3 days ago

Last modified

MCP Server Security Scanner (n8n + MCP configs)

Security scanner for n8n workflow exports and MCP server configurations, built from the open-source FlowSentry engine. 18 rules mapped to the OWASP Agentic Top 10.

What it detects

Webhooks without authentication (critical)
Hardcoded secrets in node parameters and HTTP headers (critical)
Command injection via Execute Command nodes (critical)
Overly permissive CORS / file access
Prompt-injection-prone LLM nodes with untrusted input
And 13 more rules - see the full list in the repository

How to use

Try it instantly: leave "Scan built-in vulnerable example" checked and run - you get real findings from a bundled demo workflow.
Scan your own workflow: paste your n8n workflow export JSON into "Workflow JSON" and run.
Check the output dataset for findings with rule id, severity, affected node, message, remediation and evidence.

Output

The default dataset contains one item:

{
  "files_scanned": 1,
  "summary": { "critical": 2, "high": 1, "medium": 1, "low": 0, "info": 0 },
  "findings": [
    {
      "rule_id": "FS001",
      "severity": "critical",
      "node": "Webhook",
      "message": "Webhook has no authentication",
      "remediation": "Enable basic auth or header auth on the webhook node"
    }
  ]
}

Options

Workflow JSON: your n8n export (the { "nodes": [...] } object or the full export file).
Scan built-in vulnerable example: run against the bundled demo workflow.
Fail run at severity: mark the run FAILED when findings at/above this severity exist (never disables). Useful in CI pipelines - schedule the Actor against your workflow repository folder.

Need deeper scans?

The full engine (18 rules, SARIF 2.1.0 reports, CI mode) is open source at github.com/vasilicasijarvis/flowsentry (pip install flowsentry), and there's a free in-browser scanner at flowsentry.vercel.app.

MCP Server Security & Trust Scanner

abhi72/mcp-security-scanner

Audits Model Context Protocol (MCP) servers for security & trust issues: missing auth, SSRF exposure, secret leaks, prompt-injection risk, and error handling. Get a scored (A-F), shareable report before connecting any MCP server to your AI agents.

Abhishek Kumar

Repo Security Scanner — Malicious Code & Supply Chain

eltociear/mcp-server-security-scanner

Run a supply chain audit on any GitHub repo before you install or depend on it. Scans for malicious code, install-time execution, credential exfiltration and prompt injection. Vet npm/PyPI package sources and MCP servers. Code and docs get separate risk levels, with file/line evidence.

Ikko Eltociear Ashimine

AI Agent & MCP Security Scanner: Detect Vulnerabilities

neon_innovation_lab/mcp-security-auditor

Automated security audit tool for MCP servers and agent endpoints. Scans tool schemas, detects insecure file operations, and flags prompt injection risks.

Neon Innovation Lab

Crypto Token Rug Check — Honeypot & Security Scanner

agent_services/crypto-rug-check

Instant rug-pull risk scan for any token across 8 chains (Base, Ethereum, BSC, Solana & more). Honeypot simulation, ownership/mint checks, taxes, LP lock, holder concentration — one SAFE/WARN/DANGER verdict with a 0-100 risk score. Free data sources, no API keys needed.

Riley Craig

2.0

(1)

🛡️ AI Agent & MCP Security Scanner

inexhaustible_glass/agent-security-scanner

Scan GitHub repos for AI-agent, MCP-server & skill security risks: prompt injection, tool poisoning, hallucinated packages, secrets & dangerous code.

Hitman studio

Agent Security Scanner

folkloric_morale/agent-security-scanner

Scan AI agent repos, MCP servers, and coding-agent configs for unsafe eval, shell execution, package hallucinations, prompt injection, and MCP security risks.

ProofLayer

A2A Agent Card Security Scanner: Identity, Auth & SSRF

neon_innovation_lab/a2a-agent-card-security-scanner

Automated security linter for Agent2Agent (A2A) Agent Cards (/.well-known/agent-card.json). Audits cryptographic JWS signatures, SSRF risks, prompt injections, and unauthenticated dangerous primitives.

Neon Innovation Lab

GitHub MCP Registry Servers Scraper

automation-lab/github-mcp-registry-catalog

Search and export official MCP Registry server records with publisher, repository, package, endpoint, transport, version, and lifecycle metadata.

Automation Lab

Firebase Firestore Security Audit - Find if-true Leaks Free

renzomacar/firebase-security-auditor

Free Firebase Firestore security audit: static analyzer for firestore.rules + a live anonymous probe. Detects 'if true' wide-open rules, expired test-mode, auth-only patterns and open storage, then confirms which are truly exposed. HTML report with paste-ready fix snippets. By Renzo Madueno.

Renzo Madueno

NPM Package Health Enricher

nxv107/npm-package-health-enricher

Enrich npm packages with downloads, license, repository, freshness, maintainers, deprecation status, and practical health flags.

Navpreet Singh

MCP Registry API — Server Metadata Export

tugelbay/multi-registry-mcp-intelligence

Search the official MCP Registry API and export server names, descriptions, versions, lifecycle status, repositories, and update dates as JSON or CSV.