home / skills / contextware / skills / mcp-security-scanner

mcp-security-scanner skill

needs review

/skills/mcp-security-scanner

This skill scans MCP servers for unprotected endpoints and reports authentication status to help secure local networks.

npx playbooks add skill contextware/skills --skill mcp-security-scanner

Review the files below or copy the command above to add this skill to your agents.

Files (1)

SKILL.md

2.8 KB

---
name: mcp-security-scanner
description: Scan for unprotected MCP servers using @contextware/mcp-scan package. Enables security auditing of local AI tools and network endpoints.
version: 1.0.0
author: ContextWare
mcp-servers: []
tags: [security, mcp, audit, scanning, contextware]
---

# MCP Security Scanner Skill

This skill enables agents to audit MCP servers for security issues. Use when user wants to scan for unprotected MCP endpoints.

## When to Use

- User asks to "scan for MCP servers"
- User wants to "audit MCP security"
- User asks to "check if MCP servers are protected"
- User mentions "unprotected" or "exposed" MCP servers

## Prerequisites

### Package Dependency
Uses `@contextware/mcp-scan` npm package.

**Installation:**
```bash
npm install -g @contextware/mcp-scan
```

Or run directly:
```bash
npx @contextware/mcp-scan <command>
```

### Runtime
- Node.js 18+
- Network access (for network scanning)
- Read access to config directories

## Workflow

### Phase 1: Assess Request

Clarify:
1. What to scan - localhost, local network, or specific targets?
2. Scope - network scan, config scan, or both?
3. Purpose - security audit, troubleshooting, or general discovery?
4. Very important - do not go into a loop calling this scanning tool. Never. And explain to the user that its not recommended to do scanning in a never ending loop.

### Phase 2: Execute Scans

**Network Scan:**
```bash
mcp-scan network <target>
```
Targets: localhost, local, CIDR (e.g., 192.168.1.0/24), or IP/domain

Options: -p <ports>, -t <timeout>, --https

**Config Scan:**
```bash
mcp-scan configs
```
Checks: Claude Desktop, Cursor, Continue.dev, Windsurf, Zed configs

**Full Scan:**
```bash
mcp-scan all <target>
```

### Phase 3: Present Results

- List servers with host, port, type, auth status
- Flag unprotected servers (requiresAuth: false)
- Provide remediation recommendations

### Phase 4: Safety Review

**Verify permission:** Only scan networks you own or have explicit authorization.

**Decline requests** to scan unknown targets. Offer to scan owned systems instead.

## Safety Guidelines

**What This Tool Does:**
- Sends HTTP requests to detect MCP endpoints
- Reads local config files
- Reports authentication status
- Read-only (no modifications)

**What This Tool Does NOT Do:**
- Does not modify any files
- Does not execute commands from configs
- Does not send data to external servers
- Does not exploit vulnerabilities

## Troubleshooting

**"mcp-scan: command not found"**
-> Install: npm install -g @contextware/mcp-scan

**"No servers found" but one is running**
-> Try custom ports: -p 8080,9000
-> Or use --https flag

**Scan times out**
-> Increase timeout: -t 5000

## References

- Package: https://npmjs.com/package/@contextware/mcp-scan
- Source: https://github.com/contextware/mcp-scan
- MCP Protocol: https://modelcontextprotocol.io

Overview

This skill scans for unprotected MCP (Model Context Protocol) servers using the @contextware/mcp-scan package. It enables quick security audits of local AI tool endpoints and network targets to identify servers that do not require authentication. The skill is designed for read-only discovery and remediation guidance.

How this skill works

The skill runs network and configuration scans using the mcp-scan CLI to detect MCP endpoints, determine host/port/type, and check authentication status. It can inspect local config files for known AI tools and perform targeted or CIDR-based network probes. Results are summarized with flags for unprotected servers and recommended fixes.

When to use it

Audit local machines or home lab for exposed MCP servers
Scan a trusted network range (e.g., 192.168.1.0/24) for MCP endpoints
Check application configs (Claude Desktop, Cursor, Continue.dev, Windsurf, Zed) for MCP settings
Verify whether a specific host or domain requires MCP authentication
Perform a security review before exposing services externally

Best practices

Only scan systems and networks you own or have explicit permission to audit
Clarify scope: localhost vs. local network vs. specific IPs/domains before running scans
Start with a config scan to identify local endpoints, then run targeted network probes
Use timeouts and port lists to limit scan duration (e.g., -t and -p options)
Avoid automated continuous scanning loops; run audits on a schedule or manually

Example use cases

Check a developer workstation for exposed MCP servers before joining a corporate network
Scan a lab subnet to find devices with MCP endpoints that lack authentication
Audit configuration directories to spot default or missing credentials in known apps
Validate remediation after adding authentication to an MCP service
Troubleshoot an app that should be listening locally but does not appear in discovery

FAQ

Do I need special permissions or tools to run this skill?

You need Node.js 18+ and the @contextware/mcp-scan package (installable via npm or npx). Ensure you have network read access and permission to scan the targets.

Will the scanner change files or exploit vulnerabilities?

No. The scanner performs read-only probes and configuration inspections. It does not modify files, execute commands from configs, or attempt to exploit systems.