MCP Server Scanner

Created By
m-q-ta year ago
detect exposed mcp servers over the internet and enumerate their tools
Overview

What is MCP Server Scanner?

MCP Server Scanner is a tool designed to detect exposed MCP servers over the internet and enumerate their available tools. It serves as a prototype for testing hypotheses regarding the security of these servers.

How to use MCP Server Scanner?

To use the MCP Server Scanner, provide the base HTTP URL of the MCP server along with an optional timeout parameter. The command format is:

./mcp-scanner -url http://REDACTED -timeout 5

Key features of MCP Server Scanner?

  • Detects MCP servers running over Server-Sent Events (SSE).
  • Enumerates available tools on the detected servers.
  • Provides insights into the security measures implemented by the servers.

Use cases of MCP Server Scanner?

  1. Identifying internet-exposed MCP servers for security assessments.
  2. Testing the implementation of security measures on MCP servers.
  3. Researching the capabilities of various MCP servers.

FAQ from MCP Server Scanner?

  • Is MCP Server Scanner production-ready?

No, it is a quick prototype and not intended for production use.

  • What programming language is used for MCP Server Scanner?

The tool is developed in Go.

  • Can it detect all types of MCP servers?

It is designed to detect MCP servers that utilize Server-Sent Events (SSE).

Project Info
Created At
a year ago
Updated At
a year ago
Author Name
m-q-t
Star
0
Language
Go
License
-

Recommend Servers

View All
Payai X402 Tools

an hour ago
Payai X402 Tools

an hour ago
AI Work Market — USDC settlement rails for AI labor on Base Mainnet)
@Dario (DME)

AI Work Market is a USDC escrow protocol on Base Mainnet, designed for autonomous AI agents to find work, post jobs, and settle payments without humans in the loop. This MCP server exposes 10 tools: **Escrow lifecycle** - `create_intent_quote` — get calldata + gas estimate for funding a new escrow intent - `submit_proof_quote` — get calldata for the seller to submit a proof URI - `release_funds_quote` — get calldata for the buyer to release payment (or claim/refund) **x402 single-call binding** - `x402_consume` — replaces the 5-step x402 flow with one HMAC-signed POST that returns a delivery URL **Onboarding & discovery** - `agent_onboard` — generate a signed agent card with marketplace attestation - `agent_search` — tf-idf search over the live agent catalog - `agent_reputation` — server-side reputation from on-chain Released/Refunded/Disputed events **Live state** - `system_status` — live on-chain state (nextIntentId, accumulatedFees, contract balance, owner) - `escrow_rules` — contract semantics, lifecycle, call guides, failure modes - `events_subscribe` — SSE stream of new on-chain intent events All endpoints are serverless (Vercel) and return their schema on GET. No browser, no wallet UI required for an agent to integrate. The protocol takes a 1% commission on every settlement; the rest goes to the seller. The full AgentCard is at `/.well-known/agent-card.json` (A2A-compatible). The OpenAPI 3.0.3 spec is at `/.well-known/openapi.json` with `components.securitySchemes` (none, hmacX402). `robots.txt` allows GPTBot, ClaudeBot, anthropic-ai, PerplexityBot, Google-Extended, Applebot-Extended, CCBot, Amazonbot.

a day ago