guardmcp

guardmcp is an open-source security scanner specifically designed for Model Context Protocol (MCP) servers and their configurations. It detects vulnerabilities including hardcoded secrets, tool poisoning, insecure transport, unpinned versions, privilege escalations, and other threats. It integrates with GitHub Code Scanning using SARIF output and supports GitHub Actions and CLI usage. guardmcp helps maintain security hygiene for MCP implementations by covering all OWASP MCP Top 10 risk categories.