Security scanner for MCP servers. Detects SSRF, path traversal, injection vulnerabilities. Snyk for MCP.
Three tools with clear, action-verb names (shield_scan_*) and adequate descriptions (50-80 chars each). All have proper JSON Schema with required fields and type declarations. However, parameter descriptions are minimal (e.g., 'Path to the file to scan' lacks format/constraint guidance). No output schema documented, LLMs cannot predict response structure. No error handling guidance. Missing tool annotations (readOnlyHint present conceptually but not declared in schema). Baseline: avg tool description ~194 chars; these are ~65 chars. Avg params per tool: 1.3 (well below baseline 4), suggesting oversimplification.
Scan a code snippet for MCP security vulnerabilities.
Scan an entire directory/project for MCP security vulnerabilities.
Scan a source file for MCP security vulnerabilities (SSRF, path traversal, injection, secrets, auth).
No output schema documented. LLMs cannot predict response structure (findings format, field names, severity levels). Baseline: 100% of A+ tools document return types.
Parameter descriptions lack format/constraint guidance. 'Path to the file to scan' does not specify: absolute vs relative, file extensions accepted, max path length, or error behavior for non-existent paths. Baseline: descriptions should state format, range, and allowed values.
No error handling guidance. If a file is not found, unreadable, or contains unsupported syntax, the tool response does not guide the LLM on recovery. Baseline: error responses must tell the LLM what to do next.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | C | 66 | 2026-07-28+ | v2 |
Tool annotations missing. 'Risk: READ_ONLY' is noted in metadata but not declared in the schema via readOnlyHint. LLMs cannot infer safety from undeclared hints.
Minimal parameter count (1 - 2 per tool) suggests oversimplification. No pagination, filtering, or result-limiting parameters. If scanning large directories, response could exceed context window without documented limits.