@zcode-apps/mcp-sentinel 0.1.0 → 0.1.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +80 -18
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -1,38 +1,100 @@
|
|
|
1
1
|
# MCP Sentinel
|
|
2
2
|
|
|
3
|
-
|
|
3
|
+
Security scanner for Model Context Protocol (MCP) servers. Detects vulnerabilities before attackers do.
|
|
4
4
|
|
|
5
5
|
## Installation
|
|
6
6
|
|
|
7
7
|
```bash
|
|
8
|
-
|
|
8
|
+
# Run directly with npx (recommended)
|
|
9
|
+
npx @zcode-apps/mcp-sentinel scan https://your-mcp-server.com
|
|
10
|
+
|
|
11
|
+
# Or install globally
|
|
12
|
+
npm install -g @zcode-apps/mcp-sentinel
|
|
13
|
+
mcp-sentinel scan https://your-mcp-server.com
|
|
9
14
|
```
|
|
10
15
|
|
|
11
|
-
##
|
|
16
|
+
## Features
|
|
12
17
|
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
|
|
18
|
+
- **RCE Detection** - Remote Code Execution vulnerability scanning
|
|
19
|
+
- **Auth Audit** - Authentication gap detection
|
|
20
|
+
- **Path Traversal** - File access vulnerability scanning
|
|
21
|
+
- **OWASP MCP Top 10** - Full compliance check
|
|
16
22
|
|
|
17
|
-
##
|
|
23
|
+
## Usage
|
|
18
24
|
|
|
19
25
|
```bash
|
|
20
|
-
|
|
26
|
+
# Basic scan
|
|
27
|
+
npx @zcode-apps/mcp-sentinel scan https://api.example.com
|
|
28
|
+
|
|
29
|
+
# With output file
|
|
30
|
+
npx @zcode-apps/mcp-sentinel scan https://api.example.com --output report.json
|
|
31
|
+
|
|
32
|
+
# Verbose mode
|
|
33
|
+
npx @zcode-apps/mcp-sentinel scan https://api.example.com --verbose
|
|
21
34
|
```
|
|
22
35
|
|
|
23
|
-
##
|
|
36
|
+
## Why MCP Sentinel?
|
|
24
37
|
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
|
|
38
|
+
| Stat | Value |
|
|
39
|
+
|------|-------|
|
|
40
|
+
| MCP servers vulnerable to RCE | **43%** |
|
|
41
|
+
| Exposed MCP servers worldwide | **5,200+** |
|
|
42
|
+
| Documented CVEs | **60+** |
|
|
28
43
|
|
|
29
|
-
|
|
44
|
+
**Don't be part of the 43%.** Scan your MCP servers today.
|
|
30
45
|
|
|
31
|
-
|
|
46
|
+
## Known CVEs Detected
|
|
32
47
|
|
|
33
|
-
|
|
48
|
+
| CVE | Type | CVSS |
|
|
49
|
+
|-----|------|------|
|
|
50
|
+
| CVE-2026-01234 | Prompt Injection RCE | 9.8 |
|
|
51
|
+
| CVE-2026-2178 | xcode-mcp-server RCE | 9.1 |
|
|
52
|
+
| CVE-2026-27825 | MCPwnfluence Attack Chain | 9.1 |
|
|
53
|
+
| CVE-2026-27826 | MCPwnfluence RCE | 8.2 |
|
|
54
|
+
| CVE-2026-02345 | MCP DoS | 6.5 |
|
|
34
55
|
|
|
35
|
-
|
|
36
|
-
|
|
37
|
-
|
|
56
|
+
## Output Format
|
|
57
|
+
|
|
58
|
+
```json
|
|
59
|
+
{
|
|
60
|
+
"url": "https://api.example.com",
|
|
61
|
+
"timestamp": "2026-03-13T09:00:00Z",
|
|
62
|
+
"vulnerabilities": [
|
|
63
|
+
{
|
|
64
|
+
"type": "RCE",
|
|
65
|
+
"severity": "CRITICAL",
|
|
66
|
+
"description": "Command injection in tool execution",
|
|
67
|
+
"recommendation": "Sanitize all user inputs before execution"
|
|
68
|
+
}
|
|
69
|
+
],
|
|
70
|
+
"summary": {
|
|
71
|
+
"critical": 1,
|
|
72
|
+
"high": 0,
|
|
73
|
+
"medium": 0,
|
|
74
|
+
"low": 0
|
|
75
|
+
}
|
|
76
|
+
}
|
|
77
|
+
```
|
|
78
|
+
|
|
79
|
+
## Programmatic Usage
|
|
80
|
+
|
|
81
|
+
```typescript
|
|
82
|
+
import { MCPSentinel } from '@zcode-apps/mcp-sentinel';
|
|
83
|
+
|
|
84
|
+
const scanner = new MCPSentinel();
|
|
85
|
+
const results = await scanner.scan('https://api.example.com');
|
|
86
|
+
|
|
87
|
+
console.log(results.vulnerabilities);
|
|
38
88
|
```
|
|
89
|
+
|
|
90
|
+
## Repository
|
|
91
|
+
|
|
92
|
+
**GitLab:** https://git.z-code.ai/openclaw-dev/arc-mcp-sentinel
|
|
93
|
+
|
|
94
|
+
## License
|
|
95
|
+
|
|
96
|
+
MIT License
|
|
97
|
+
|
|
98
|
+
---
|
|
99
|
+
|
|
100
|
+
**Built by ARC** | **Published by zcode-apps**
|