mcpsweep is an open-source discovery & vulnerability scanner for Model Context
Protocol servers. Point it at a host or subnet; it fingerprints every endpoint — legacy
initialize and the modern server/discover — enumerates tools, and
flags poisoning, transport flaws, auth gaps, and known-vulnerable versions.
Zero dependencies. Read-only. 100% local — no cloud, no LLM.
$ mcpsweep 10.10.0.0/24 --ports 8000-9100 --deep --auth-probe found http://10.10.0.31:8090/mcp/api CRITICAL (6 tools) found http://10.10.0.42:9100/mcp CRITICAL (4 tools) found http://10.10.0.17:8080/sse HIGH (2 tools) [MCP] http://10.10.0.31:8090/mcp/api CRITICAL (score 228) server : vulnlab-mcp v0.6.3 proto=2026-07-28 era=modern ![ server/discover without credentials (no authentication) ![ dns-rebinding: accepts a foreign Origin/Host (browser-pivot) ![ cors-reflect-credentials: reflects Origin + allows credentials ![ known-vulnerable: matches CVE-2025-6514 (command-injection, 9.6) ![ 1 tool description POISONED: read-notes ![ hidden-characters: tool 'fetch-url' metadata contains unicode-tag-block
Every check is read-only by default and runs entirely on your machine.
Sweep hosts, subnets and port ranges for live MCP endpoints — including the shadow servers nobody registered.
Fingerprints both the initialize handshake and the stateless
server/discover of spec 2026-07-28. Modern-only servers that reject
initialize are still found.
DNS-rebinding, wildcard/credentialed CORS, LAN exposure (NeighborJack), and sibling-endpoint auth gaps — live checks a source scanner can't do.
Full-schema poisoning (param names, enums, annotations), ANSI / zero-width / Unicode TAG-block concealment, and tool shadowing across servers.
Signatures every tool; diff flags a definition that silently changed since
your baseline — the MCPoison pattern.
No-auth detection, OAuth 2.1 metadata validation (RFC 9728/8414), SSRF/scheme/scope hygiene — and it refuses to fetch an internal target itself.
Matches serverInfo against a bundled, offline advisory database — no
OSV/NVD calls, ever.
Classifies parameters as command-injection, SQLi, path-traversal or SSRF sinks, and spots read-only-lie annotations and argument injection.
lint-config audits local mcp.json for curl|sh,
unpinned npx -y, inline-eval and plaintext secrets.
Mapped check-by-check to the OWASP MCP Top 10 and real CVEs. Full table in CVE-COVERAGE.md.
Detects the real-world classes behind CVE-2025-6514, CVE-2025-66414/66416, CVE-2026-33032, CVE-2026-49257, CVE-2025-54136, CVE-2026-51994, CVE-2026-52870 and more.
Other MCP scanners upload your tool metadata to a cloud, need an API key, or only read source. mcpsweep is the one that sweeps the network and keeps everything on your box.
| Capability | mcpsweep | cloud scanners | source scanners |
|---|---|---|---|
| Network discovery of live + shadow servers | ✓ | — | — |
| Zero runtime dependencies | ✓ | — | — |
| 100% local — no cloud, no LLM | ✓ | uploads metadata | varies |
| Live transport probes (DNS-rebind, CORS) | ✓ | partial | — |
Modern server/discover (2026-07-28) | ✓ | varies | — |
| Read-only by default | ✓ | varies | ✓ |
| SARIF → CI code-scanning | ✓ | varies | varies |
Python 3.8+. Nothing else.
mcpsweep 10.10.0.31 --ports 8090mcpsweep 10.10.0.0/24 --ports 8000-9100 --deep --auth-probemcpsweep … -f sarif -o mcp.sarif --fail-on highmcpsweep lint-config ~/.cursor/mcp.jsonmcpsweep diff last.json now.json --fail-on-driftmcpsweep … --proxy http://127.0.0.1:8080python -m vulnlab, then scan 127.0.0.1:9100.