MCPScan: Zero-Telemetry MCP Security Auditor

Zero-telemetry security auditor in Go that discovers shadow MCP servers, audits auth posture, flags risky tool parameters, and protects AI dev workflows from rug-pulls.

Comment

Inspiration

As AI developer workflows rapidly shift to autonomous coding agents (Claude Desktop, Cursor, Antigravity, VS Code), the Model Context Protocol (MCP) has become the universal standard connecting LLMs to databases, terminals, and internal APIs. However, we noticed a critical security blind spot:

  • Developers frequently bind MCP microservices to 0.0.0.0 over unencrypted HTTP without authentication or TLS.
  • An attacker on the same local subnet (or compromised container) can enumerate tools and execute raw shell commands, SQL queries, or file reads with the agent's host permissions.
  • Local AI client registries store sensitive API keys in plaintext arguments.
  • There was zero dedicated tooling to passively sweep subnets for shadow MCP endpoints, detect tool mutations, or audit authentication postures without disrupting live servers. We built MCPScan to provide security engineers and AI developers with an ultra-fast, zero-telemetry, single-binary defense solution.

What it does

MCPScan is an open-source, local-only security scanner and authentication auditor for Model Context Protocol infrastructure:

  1. 🌐 Concurrent Network Discovery: Sweeps RFC1918 private subnets and localhost using bounded worker pools (500 req/s) with a 3-layer JSON-RPC protocol handshake.
  2. 🔒 Non-Intrusive Auth Auditing: Evaluates authentication enforcement (401/403 challenges vs unprotected exposure) sending exactly one probe per server with zero side-effects.
  3. ⚠️ Danger Parameter Heuristics: Automatically inspects tools/list schemas and flags unconstrained high-risk parameters (command, path, sql, filepath, token).
  4. 🔍 Local AI Tool Stdio Discovery: Audits local client registrations (Antigravity IDE, Claude Desktop, Cursor, VS Code) and correlates configs with running OS processes (heuristic PID matching).
  5. 🛡️ Two-Layer Credential Masking: Masks sensitive API keys and tokens (AQ....89w, ghp_...) in terminal logs, and strictly enforces zero storage of confidential environment variables.
  6. 🧬 Rug-Pull Integrity Verification: Generates deterministic canonical SHA-256 tool digests to detect silent capability injections or unauthorized schema tampering.
  7. 📊 DevSecOps JSON & SQLite Persistence: Saves historical audits to an embedded SQLite database and outputs machine-readable JSON for automated CI/CD security quality gates.

How we built it

  • Language: Pure Go (Golang) with zero CGO and zero external runtime dependencies.
  • Concurrency: Thread-safe goroutine worker pools with rate-limiting to prevent network saturation.
  • Database: Embedded SQLite with automatic schema migration and foreign key cascade protection.
  • Protocol Handshakes: Custom RFC-compliant JSON-RPC 2.0 client supporting initialize and tools/list protocol negotiation.
  • Integrity Engine: Canonical JSON serialization invariant to whitespace or key-ordering differences before computing SHA-256 checksums.

Challenges we ran into

  • Zero-Side-Effect Auditing: We had to ensure that probing an MCP server never triggered unintended tool executions (like executing a shell command or running an UPDATE query). We solved this by strictly probing read-only protocol handshakes and challenge headers.
  • Non-Elevated Process Matching: Matching configured stdio tools to live OS processes across Windows and Unix without requiring administrator/root privileges required lightweight, cross-platform process tree inspection.
  • Preventing False Positives on Port Reuse: If a developer shuts down a server and starts a different service on the same port, naive diffing triggers false "modified" alarms. We engineered state-machine disambiguation (new, unchanged, modified, replaced).

Accomplishments that we're proud of

  • 100% Zero-Telemetry Guarantee: MCPScan makes zero external network requests to any cloud analytics or tracking endpoints. It operates 100% offline.
  • Lightning Performance: Targeted scans complete in under 8 milliseconds, and full subnet sweeps finish in ~2 seconds.
  • Full-Spectrum Visibility: Single CLI that bridges network HTTP listeners, TLS wire encryption, and local desktop AI IDE configurations.

What we learned

We deepened our understanding of the emerging Model Context Protocol specification (2024-11-05), JSON-RPC 2.0 transport state machines, deterministic canonical hashing, and building zero-dependency security tools in Go.

What's next for MCPScan: Zero-Telemetry MCP Security Auditor

  • Real-time daemon mode with OS notifications when an AI agent connects to an unauthenticated MCP server.
  • Native GitHub Actions integration for automated PR security checks on new MCP tool definitions.
  • Support for SSE (Server-Sent Events) streaming transport auditing.

Built With

Share this project:

Updates