35+ checks across transport security, authentication, MCP protocol compliance, injection risks, information disclosure, security headers, and rate limiting — plus checks built for the new stateless 2026-07-28 spec. Paste a URL and get results in seconds. Once your server is hardened, test how Claude, GPT, and Gemini actually call your tools in live AI conversations.
Everything above runs unauthenticated, so it can only judge what your server exposes to a stranger. The risks that actually cost people money — a secret leaked through a tool response, a poisoned tool description, a definition that quietly changed since you approved it — are only visible from the inside. The signed-in scanner connects with your credentials and organises every finding under the ten OWASP MCP categories.
| Capability | Free scan | Advanced scan |
|---|---|---|
| What it can reach | The unauthenticated surface only | Connects with your stored credentials |
| Tool responses | Not read — no tools are called | Read-only tools called, responses scanned for leaked secrets and PII |
| Agentic checks | None | An AI designs probes for injection, poisoning and intent subversion |
| Change detection | Single point-in-time result | Tool definitions pinned to a baseline — a rug pull shows as a diff |
| Reporting | A graded checklist | Per-tool matrix, findings mapped to OWASP MCP Top 10, re-runnable |
[ COVERAGE ]
Two of the ten cannot be established by probing a URL — they are properties of your organisation, not of one endpoint. Those are marked, and the report never dresses a self-certified answer up as a probed one.
Token Mismanagement & Secret Exposure
Privilege Escalation via Scope Creep
Tool Poisoning
Software Supply Chain Attacks & Dependency Tampering
Command Injection & Execution
Intent Flow Subversion
Insufficient Authentication & Authorization
Lack of Audit & Telemetry
Shadow MCP Servers
Context Injection & Over-Sharing
[ SCAN DEPTHS ]
No credentials, no side effects.
Reads the unauthenticated surface only — transport, auth enforcement, and tool descriptions. No AI agent, no charge.
Calls read-only tools with ordinary inputs.
Calls read-only tools and reads real responses to find leaked secrets and oversharing. With your consent an AI reviews the tool descriptions for poisoning. Ordinary inputs only — nothing adversarial is sent (uses credits).
Adversarial payloads. Verified or attested hosts only.
Sends crafted attack payloads — path traversal, shell metacharacters, SQL-shaped arguments — and runs an AI agent that designs more of the same against your read-only tools. Requires a verified host, or an explicit attestation under tight limits (uses credits).
Adversarial payloads are never sent to a server you have not proved you control. The active depth requires a verified host — by DNS TXT record or .well-known file — or an explicit written attestation under hard rate limits.
Run the full OWASP MCP Top 10 against your server
Scans are org-scoped, so findings are shared with your team. Credentials are encrypted and never returned to the browser.
Done scanning? Go further.
Connect your hardened server to AI — test how Claude, GPT & Gemini call your tools, compare models, or build a reusable agent your whole team uses daily.
✦ Free credits on sign-up · no credit card needed
A February 2026 security scan found over 8,000 MCP servers exposed on the public internet with no authentication. Any AI agent — or malicious actor — can connect to those servers, enumerate their tools, and call them without restriction.
Palo Alto Unit 42 published research in early 2026 identifying new attack vectors specific to MCP: tool poisoning (manipulating tool descriptions to hijack agent behavior) and sampling injection. Both require an attacker to first reach your server — authentication is your first line of defense.
This free scanner checks the most critical security properties of your MCP server and gives you a prioritized list of what to fix.
Access-Control-Allow-Origin: * means any website can make authenticated-looking requests to your server from a visitor's browser.Strict-Transport-Security: max-age=31536000 header in your server's response or in your reverse proxy config.* with your specific allowed origins, e.g. https://claude.ai or your application domain.X-Content-Type-Options: nosniff and X-Frame-Options: SAMEORIGIN can be added in a single middleware or proxy config block.For step-by-step implementation with code examples, read our guide on securing MCP servers with OAuth 2.1, Bearer tokens, and Cloudflare Access.
readOnlyHint: true, with generated placeholder arguments — a server that annotates nothing is never called. If your server exposes a tool annotated read-only that is not, scan a staging instance first.Credentials optional — add them to unlock deeper checks on auth-protected servers
35+ checks across 8 categories — including the latest MCP spec
Transport Security
HTTPS, TLS cert validity, HTTP redirect, HSTS
Authentication & Access
Auth enforcement, tools/list & resources/list exposure, OAuth 2.0 metadata, token validation*
MCP Protocol
Initialize handshake, unknown method error handling
Stateless Spec (2026-07-28)New
requestState tampering, cacheScope leaks, server/discover, resultType, routing headers, error codes
Information Disclosure
Server headers, error verbosity, tool risk patterns, prompt injection in descriptions*
Injection & Exfiltration
Command injection, code injection, path traversal, SSRF, data exfiltration, IDOR*
Security Headers & CORS
CORS configuration, origin reflection
Resilience
10 concurrent requests — checks for 429 and rate-limit headers
* requires optional credentials