Documentation

How ShieldMCP works

ShieldMCP scans your Model Context Protocol (MCP) configuration against the OWASP MCP Top 10 — the emerging security standard for AI agent integrations. Below is what each check looks for, why it matters, and how to fix it.

Quick start

  1. 1Find your MCP config file (see locations below).
  2. 2Drop the file or paste its JSON on the home page.
  3. 3Get an instant score across all 10 OWASP categories — free, no account.
  4. 4Unlock the full report ($49 one-time) for exact copy-paste fixes and a shareable PDF.

Where is my config file?

Claude Desktop (macOS)~/Library/Application Support/Claude/claude_desktop_config.json
Claude Desktop (Windows)%APPDATA%\Claude\claude_desktop_config.json
Cursor.cursor/mcp.json (in your project) or ~/.cursor/mcp.json
Windsurf~/.codeium/windsurf/mcp_config.json
VS Code (Continue / others).vscode/mcp.json or your extension config

Your config never leaves your browser unscanned — secrets are detected by pattern, and the free scan runs without an account.

The OWASP MCP Top 10

Every scan checks your configuration against all ten categories below.

MCP01

Token Mismanagement & Secret Exposure

What it is
API keys, secrets, and access tokens stored in plaintext inside your MCP config.
Why it matters
Config files are frequently committed to git, synced to cloud drives, and shared in screenshots. A leaked OpenAI, Anthropic, GitHub, AWS, or Stripe key can be drained or abused within minutes of exposure.
What ShieldMCP checks
ShieldMCP detects 15+ known token formats (sk-, sk-ant-, ghp_, AKIA, AIza, SG., and more) plus high-entropy strings that look like secrets.
How to fix
Move secrets to environment variables or a secrets manager. Reference them by name (e.g. ${OPENAI_API_KEY}) rather than hardcoding the value in the config file.
MCP02

Privilege Escalation via Scope Creep

What it is
Servers granted far more access than they need — filesystem roots, database admin credentials, full-scope payment keys.
Why it matters
A filesystem server pointed at / or your home directory exposes SSH keys, credentials, and every file on the system to the agent. A database server with write access can destroy data. This is privilege escalation via over-broad scope.
What ShieldMCP checks
ShieldMCP flags filesystem roots (/ or home), database write access without read-only restriction, admin credentials, and live payment keys (sk_live_) as critical over-permissioning.
How to fix
Apply least privilege. Scope filesystem servers to a single project directory. Use read-only credentials where writes are not required. Use restricted API keys for payment providers.
MCP03

Tool Poisoning

What it is
MCP servers loaded from unverified or malicious sources, or configs containing hidden directives that inject instructions into the agent.
Why it matters
A malicious MCP server can inject hidden instructions into your agent via tool descriptions or embedded zero-width characters. Local filesystem packages can be silently modified on disk without the config ever changing. The postmark-mcp incident is the canonical example.
What ShieldMCP checks
ShieldMCP flags servers loaded from local filesystem paths, unscoped packages, and sources that cannot be audited against a registry. It also scans all config string values for zero-width Unicode characters and embedded directive markers (e.g. <system>, "ignore previous instructions").
How to fix
Always reference published, versioned npm packages from trusted publishers. Pin exact versions, review the source before connecting, and inspect configs copied from third-party sources for invisible characters.
MCP04

Software Supply Chain Attacks & Dependency Tampering

What it is
Risky package sourcing: Git URL installs, unpinned versions, local file deps, and dependency-confusion exposure for scoped packages.
Why it matters
An unpinned package can pull a malicious update at any time. A Git URL install bypasses the npm registry entirely — no audit, no integrity hash. A private-looking scoped package without version pinning can be hijacked via dependency confusion on the public registry.
What ShieldMCP checks
ShieldMCP flags packages without pinned versions, Git-URL installs, local file references, pre-release versions, and scoped packages outside trusted namespaces that lack an exact version pin (dependency-confusion exposure).
How to fix
Pin exact versions of every MCP package. Never use Git URL installs in production. For private scoped packages, bind the scope to your private registry in .npmrc. Review changelogs before upgrading.
MCP05

Command Injection & Execution

What it is
Shell execution patterns and dangerous commands in server definitions.
Why it matters
If an MCP server runs shell commands built from untrusted input, an attacker (or a prompt-injected model) can execute arbitrary code on your machine.
What ShieldMCP checks
ShieldMCP inspects command and args for shell interpreters (bash -c, sh -c), inline code execution flags (node -e, python -c), shell metacharacters, eval/exec patterns, and world-writable path references.
How to fix
Avoid passing dynamic input to shell interpreters. Use parameterized, allowlisted commands and never build commands from model output.
MCP06

Intent Flow Subversion

What it is
Servers that ingest untrusted external content — web pages, email, search results, messages — that can carry adversarial instructions.
Why it matters
Content fetched from the web or received via email can contain hidden instructions that the model may follow, subverting the agent's intended tool flow without the user's knowledge. This is indirect prompt injection via external data sources.
What ShieldMCP checks
ShieldMCP flags known external-ingestion servers: web fetch, browser automation (puppeteer/playwright), web search (brave-search), email readers, messaging servers, and remote HTTP/SSE transports.
How to fix
Isolate external-content-ingestion servers from high-privilege tools. Never chain a fetch/browser/email server directly with filesystem or database servers. Apply content guardrails on external responses before they reach the model context.
MCP07

Insufficient Authentication & Authorization

What it is
Insecure transport (plain HTTP), missing or weak authentication, and MCP servers bound to public network interfaces.
Why it matters
HTTP-only transports and missing API keys let attackers intercept traffic or invoke tools without credentials. Binding to 0.0.0.0 exposes the server beyond localhost — combined with no auth this allows unauthenticated remote tool invocation.
What ShieldMCP checks
ShieldMCP flags HTTP (non-TLS) transports, HTTPS servers without auth, external services with no API key, weak/placeholder credentials, and servers bound to 0.0.0.0 or non-loopback addresses.
How to fix
Always use HTTPS/TLS for remote servers. Require strong Bearer/OAuth authentication on every networked MCP endpoint. Bind servers to 127.0.0.1, not 0.0.0.0.
MCP08

Lack of Audit and Telemetry

What it is
No log trail for what the agent reads, writes, or executes.
Why it matters
Without logs there is no way to investigate a breach, prove compliance, or detect data exfiltration in progress. Destructive servers without logging are especially dangerous.
What ShieldMCP checks
ShieldMCP checks for log path / log level env vars and escalates to critical when a write-capable server has no audit trail.
How to fix
Set MCP_LOG_PATH (or the server equivalent) on every server. Log timestamp, tool, arguments, and result. Ship logs to a central, tamper-resistant store.
MCP09

Shadow MCP Servers

What it is
Hidden, duplicate, or unverified server endpoints that evade security audits.
Why it matters
Duplicate or unrecognized servers can shadow legitimate ones, intercepting tool calls or quietly adding capabilities you did not intend to grant. Generic names make them harder to audit.
What ShieldMCP checks
ShieldMCP detects duplicate package references, servers connecting to external/unverified URLs, unencrypted HTTP transports, non-standard ports, and generically-named servers.
How to fix
Maintain a known-good inventory of your MCP servers. Remove duplicates. Use descriptive names. Verify every endpoint you connect to.
MCP10

Context Injection & Over-sharing

What it is
Dangerous combinations of connected data sources and sinks that amplify PII exposure and create exfiltration paths.
Why it matters
When email, calendar, files, and a database are all exposed simultaneously, a single prompt-injection attack can pivot across all of them. A filesystem reader combined with an email sender creates a complete exfiltration path — read sensitive data here, send it out there. Attackers chain these automatically.
What ShieldMCP checks
ShieldMCP models source-to-sink combinations (filesystem + email, database + webhook, PII trifecta) and flags configurations that enable exfiltration or over-aggregation of sensitive context.
How to fix
Separate read sources from outbound sinks. Connect only the sources a given workflow needs. If both are required, add strict audit logging and human approval for outbound actions.

How scoring works

Every scan starts at 100 and deducts points per issue found, capped per severity so one category can never sink the entire score:

Critical−20 eachmax −60
High−10 eachmax −30
Medium−5 eachmax −15
Low−2 eachmax −6
80–100
Low Risk
60–79
Medium Risk
40–59
High Risk
0–39
Critical Risk

Ready to check your setup?

Run a free scan in 60 seconds — no account required.

Run Free Scan