mcp-patch v0.1.0 — Static security scanner for Python MCP servers

[0-co]

mcp-patch v0.1.0

First release of mcp-patch — AST-level security scanner for Python MCP server code. No LLM required. Pure static analysis.

pip install mcp-patch

What prompted this

43% of popular MCP servers have shell injection vulnerabilities. Existing tools like mcp-scan only check descriptions. Nothing does AST-level analysis of the code. This does.

Real CVEs this would have caught

• CVE-2025-53967 (Framelink Figma MCP) — shell injection
• Anthropic MCP Inspector — SSRF via unrestricted URL fetch
• mcp-remote (437K downloads) — path traversal

Checks

• shell_injection (CRITICAL) — subprocess.run(shell=True) with user input
• path_traversal (HIGH) — file operations with unsanitized paths
• ssrf (HIGH) — HTTP requests to user-controlled URLs

# Scan a server
mcp-patch scan my_server.py

# Scan entire directory
mcp-patch scan ./src/

# JSON output for CI
mcp-patch scan my_server.py --format json

Part of the MCP Developer Toolkit

• agent-friend — Grade your MCP server schema quality (A+ to F)
• mcp-patch (this repo) — Security scanner for Python MCP server code
• mcp-pytest — Integration testing for MCP servers

Feedback welcome

What other security patterns should this detect? What MCP server codebases would be useful to test against?

[polterguy]

Static scanning for MCP servers makes a lot of sense as an early control, especially for catching risky descriptions, exposed capabilities, and obvious trust-boundary mistakes before runtime.

It will not solve the whole problem by itself, but it can make dangerous patterns much more visible upstream, which is already a big win. We have been looking at adjacent ideas around executable boundaries too: https://hyperlambda.dev