🛡️ AI Agent & MCP Security Scanner

Scan any GitHub repo for AI-agent, MCP-server & agent-skill security risks — before you connect it to Claude Code, Cursor, or Windsurf.

Point it at a repo (or many) and get a clean, structured security report. Built for both humans (readable report) and AI agents (call it via the Apify API / as an MCP tool → structured JSON).

What it detects

Category	What it catches
🧬 MCP tool poisoning	Hidden/adversarial instructions inside MCP tool descriptions (the #1 MCP attack)
👻 Hidden Unicode	Zero-width / bidi / tag characters that hide instructions from human review
💊 Hallucinated packages	npm/PyPI dependencies that don't exist on the registry (LLM-invented, squat bait)
🎭 Typosquat packages	Dependencies one character away from a hugely popular package
⚡ Dangerous code	eval / exec / os.system / child_process / shell=True / unsafe pickle & yaml
🌐 Runtime fetch-&-exec	Code that downloads remote text/instructions and executes them
💉 Prompt injection	Jailbreak strings + user input concatenated into system prompts
🔩 MCP config risk	MCP servers that spawn a raw shell or auto-run remote packages (npx -y)
🔑 Exposed secrets	Hardcoded OpenAI / Anthropic / GitHub / AWS / Google / Slack keys

Output

Per repo you get a security score (0–100), a grade (A–D), a verdict (ALLOW / WARN / BLOCK), findings grouped by category, and every finding with file, line, severity and a snippet.

{
  "repo": "owner/repo",
  "security_score": 46,
  "grade": "D — high risk",
  "verdict": "BLOCK",
  "high_severity": 4,
  "medium_severity": 2,
  "findings_by_category": { "mcp_tool_poisoning": 1, "dangerous_code": 3, "hallucinated_package": 1 },
  "findings": [ { "file": "server.py", "line": 42, "category": "dangerous_code", "severity": "high", "title": "os.system() shell call", "snippet": "..." } ]
}

Input

{
  "repoUrls": ["https://github.com/owner/repo", "owner/another-repo"],
  "maxFiles": 400
}

• repoUrls — public GitHub repos (full URL or owner/repo).
• githubToken (optional) — raises the API limit 60→5000/hr for scanning many repos.
• maxFiles (optional) — cap files scanned per repo.

🤖 Use it from an AI agent (MCP / API)

This Actor is built for AI agents too. An assistant like Claude Code, Cursor, or Windsurf can call it as a pre-flight safety check before installing an MCP server or skill — the output is machine-readable JSON, and the verdict field (ALLOW / WARN / BLOCK) is designed to gate an agent's next action.

Call it over the Apify API:

curl -X POST "https://api.apify.com/v2/acts/<ACTOR_ID>/run-sync-get-dataset-items?token=YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"repoUrls":["owner/repo"]}'

Or expose it through the Apify MCP server so your agent can invoke "scan this repo before I connect to it" as a tool.

Why

AI agents now pull in MCP servers, skills and packages written by anyone. A single poisoned tool description or a hallucinated package name can hijack your agent or ship malware. This scanner gives you a fast, free pre-flight check on any repo — 100% public data, no code execution, no paid APIs.

---

Keywords: MCP security scanner · AI agent security · prompt injection detection · MCP tool poisoning · package hallucination · typosquat detection · supply chain security · Claude Code security · Cursor MCP · Windsurf · LLM security · agent skill audit · secrets scanning · GitHub repo security scan · model context protocol · agentic AI security · code security scanner · devsecops for AI agents.