skilldeliver

I’ve been reading about some serious security issues in MCP implementations — things like command injection, SSRF, prompt injection via tool descriptions, and even cross-server “shadowing” attacks.

Got me thinking: should there be a dedicated tool to scan and audit MCP servers?

Rough idea: something that checks for misconfigurations, scans for common vulns (RCE, path traversal, etc.), flags suspicious tool definitions, and maybe even maps out agent context chains. More like a Burp Suite or Wireshark, but for MCP.

I grabbed scanmcp.com as a placeholder — not sure if I’ll build it yet. Just wondering if there’s actual demand or if anyone else is working on something similar.

Curious what others think — especially if you’re building with agents or looking at AI security stuff.