MCP Security Methodology
How we score the security of any MCP server
Every finding cites a published taxonomy entry — mcp-scan or SAFE-MCP. No invented rules. This page is the live catalog.
Four rules our security analyzer must follow
No invented rules
Every check we run cites a public taxonomy: mcp-scan (Invariant Labs) or SAFE-MCP (a MITRE ATT&CK-style framework for MCP). If a check has no citation, it doesn't ship. The catalog below is auditable for this reason.
Deterministic first, LLM additive
Most rules run as deterministic Python over the tool metadata. The LLM judge layers on top for prompt-injection-shape detection and for context-sensitive checks like third-party origin mismatch. If the LLM judge fails or times out, the deterministic findings still ship — we never block a result on the LLM.
Metadata only — never call the tool
The analyzer reads names, descriptions, JSON Schema fields, and annotations. It never invokes a tool to find out what it does. That keeps the audit safe to run against any unverified server.
The same engine runs on the analyzer page and on every published listing
Whether you paste a URL into the public analyzer or score one of your own published servers, the rule catalog is identical. There is no privileged scoring path for partners.
Three layers, one report
Deterministic metadata
Walks the tool's name, description, JSON Schema (full recursion), and annotations. Catches steganography, schema-poisoning instructions, mutating verbs flagged read-only, homoglyph names, consent-fatigue prose, and data-harvest prose.
LLM judge (Anthropic Haiku 4.5)
Runs after the deterministic pass. Looks for instruction-control prose, third-party origin mismatch (server says it's Stripe but the host doesn't match), and credential-setup language directed at the user. Fails open on any error or 25-second timeout.
Cross-server intelligence (coming)
Compares a candidate listing to every claimed listing in our directory: host typosquats, tool-name collisions, and tool-definition drift on claimed listings. Designed; not yet shipped — we'd rather omit it than ship low-precision noise.
Every rule we evaluate
Rendered live from the analyzer source. Sorted by default severity, then category. Each citation links to the published entry on GitHub — read the source before you trust the score.
Analyzer: mcp-security-v2 · schema v2
E001CriticalPrompt injection / tool poisoning in tool description
MCPB-A002HighAnnotation honesty (read-only conflicts with mutating verbs)
E002HighCross-server tool reference (tool shadowing)
MCPB-I001HighTool name contains homoglyph / mixed-script characters
SAFE-T1402HighInstruction steganography (zero-width / HTML-comment hidden text)
SAFE-T1501HighFull-schema poisoning (instructions in JSON Schema fields)
SAFE-T1007MediumTool metadata describes credential setup or token handling
SAFE-T1804MediumTool description advertises silent data harvesting
W015MediumTool exposes agent to untrusted third-party content
SAFE-T1403MediumConsent-fatigue language pressuring auto-approval
W019MediumTool grants destructive shared-infrastructure capability
SAFE-T1004MediumThird-party tool origin / server-name mismatch
MCPB-A001LowAnnotation completeness (readOnlyHint / destructiveHint)
W020LowTool grants local destructive capability
Two published taxonomies, one rule catalog
SAFE-MCP
MITRE ATT&CK-style threat framework for MCP
A peer-reviewed taxonomy of MCP-specific adversary techniques. We cite SAFE-T1001 (instruction injection), SAFE-T1004 (third-party origin mismatch), SAFE-T1007 (credential setup), SAFE-T1402 (instruction steganography), SAFE-T1403 (consent fatigue), SAFE-T1804 (API data harvest), and a dozen more.
mcp-scan
Static scanner from Invariant Labs
The first widely-used MCP static scanner. Its issue codes (E001 prompt injection, W001 attention-control words, W015–W020 toxic flow capabilities) define a baseline that every public scoreboard expects. We cite the same codes.
About the MCPB- rule prefix
Three rules use our internal MCPB- namespace (annotation completeness, annotation honesty, duplicate display names, homoglyph names). Every one of them still cites a SAFE-MCP technique — the prefix only signals that the published taxonomy hasn't given the specific check its own ID yet. When SAFE-MCP issues one, we adopt it.