Agent Security Scanner Mcp

v3.16.0 Feature

This release adds 3 notable features for engineering teams evaluating rollout.

Published 4mo MCP Security & Auth

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

agent-security ai-agent-security ai-security claude-code codex cursor

+14 more

hallucination-detection llm-security mcp mcp-security mcp-server openclaw owasp package-hallucination prompt-injection static-analysis security supply-chain-security vulnerability-scanning windsurf

Affected surfaces

auth rbac rce_ssrf

Summary

AI summary

Updates ERROR, Bug Fixes, and Test Coverage across a mixed release.

Full changelog

v3.16.0 - MCP Scanner Hardening

9 new detection rules for comprehensive MCP manifest security scanning.

New Features

Schema-level injection detection:

mcp.schema-description-injection (ERROR) - Detects injection language in property descriptions
mcp.schema-suspicious-default (ERROR) - Flags suspicious default values with shell commands/URLs
mcp.schema-open-additionalProperties (WARNING) - Flags additionalProperties:true with empty properties

Cross-tool manipulation detection:

mcp.cross-tool-reference (ERROR) - Detects tool descriptions directing LLM to invoke other tools
mcp.cross-tool-priority-override (ERROR) - Flags tools claiming execution priority

Statistical anomaly detection:

mcp.description-length-anomaly (WARNING) - Z-score analysis to flag outlier descriptions

Suspicious URL detection:

mcp.description-suspicious-url (WARNING) - Flags external URLs in descriptions
mcp.description-tunneling-url (ERROR) - Detects ngrok, webhook.site, etc.

Nested base64 detection:

nested-base64 (ERROR) - Detects double-encoded base64 obfuscation

Bug Fixes

YAML rule paths filter support (respects paths.include/exclude)
Fixed use-escapexml false positives on JS template literals
Added .scannerrc.yaml for rule suppression
CI fork permission handling

Test Coverage

17 new tests (100% pass rate)
14 new tests in scan-mcp.test.js
3 new tests in scan-prompt.test.js

Contributors

@Har1sh-k - PR #20 (scanner hardening, path filter fix, CI improvements)

See CHANGELOG for full details.

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track Agent Security Scanner Mcp

Get notified when new releases ship.

About Agent Security Scanner Mcp

All releases →