# MCP Security Scanner — Free Online MCP Server Security Audit

> Runs 35+ checks against any MCP server URL across transport security, authentication, protocol compliance, injection risk, information disclosure, CORS policy, security headers and rate limiting. Graded A–F in seconds.

**Source:** https://mcpplaygroundonline.com/mcp-security-scanner

---

## What it scans

- **Transport security** — TLS posture and downgrade exposure
- **Authentication** — is the server actually protected, and does it challenge correctly?
- **MCP protocol compliance** — spec conformance issues that become security issues
- **Injection risk** — prompt-injection and tool-poisoning surface in tool descriptions and results
- **Information disclosure** — what leaks in errors, metadata and verbose responses
- **CORS policy** — who is allowed to talk to this server from a browser
- **Security headers**
- **Rate limiting**

## Stateless 2026-07-28 coverage

The scanner supports the stateless 2026-07-28 revision, including checks specific to it: **`requestState` tampering** and **cache-scope leaks**. These are new classes of issue that did not exist in the session-based model — state that used to live on the server now travels with the request, so its integrity and its scoping both become attack surface.

## Why MCP servers need this specifically

An MCP server is not just an API — it is an API that an autonomous agent will call with arguments it constructed itself, based on descriptions you wrote. That widens the threat model: a tool description is an input to a model, which makes it an injection vector. A permissive CORS policy on a normal API is a nuisance; on an MCP server holding a user's tokens it is an exfiltration path.

## Using it

Paste a server URL at [https://mcpplaygroundonline.com/mcp-security-scanner](https://mcpplaygroundonline.com/mcp-security-scanner) and read the graded report. It is free and needs no sign-up.

Scan servers you own or are authorised to test.

---

_Canonical page: https://mcpplaygroundonline.com/mcp-security-scanner_

_MCP Playground (mcpplaygroundonline.com) is a free, browser-based toolkit for the Model Context Protocol: test any remote MCP server, run evals that prove an AI agent can use its tools, build reusable agents across 60+ models, and audit servers for security issues. No install, no local Node, free to start._