New MCP Server Code Scanner for detecting security issues in MCP server source:

Tool Poisoning Detection (MCP101):
- Hidden XML/HTML instruction tags (<hidden>, <system>, <secret>)
- Prompt injection patterns (ignore previous, new instructions)
- Data exfiltration instructions (secretly send, include file in response)
- Zero-width/bidirectional text characters hiding content

Injection Detection:
- MCP102: Command injection (child_process, subprocess, exec, eval)
- MCP103: SQL injection (string concatenation, template literals, f-strings)

Data Exfiltration (MCP111):
- Reading sensitive files (~/.ssh, ~/.aws, credentials)
- Sending data to external servers
- Dynamic environment variable access

Security Annotations:
- MCP108: Missing destructiveHint on delete/remove operations
- MCP109: Missing readOnlyHint on read-only operations
- MCP110: Dynamic instruction loading (rug pull risk)

Also detects:
- MCP107: Hardcoded credentials in server code

Supports TypeScript/JavaScript and Python MCP servers.
Scanner count: 44+ → 45+

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>