v1.1.1 — 55 Security Checks

mcp-security-scanner v1.1.1

What's New

12 new advanced runtime security checks — bringing the total from 43 to 55 tools.

New Tools

Tool	OWASP	Description
rt_check_oauth	MCP07	OAuth/token authentication validation
rt_check_tls	MCP07	TLS certificate inspection (self-signed, expired, weak keys)
rt_check_capabilities	MCP01	Server capabilities & experimental features audit
rt_check_resource_content	MCP03	Resource content scanning for poisoning patterns
rt_fuzz_tools	MCP05	Fuzz testing with edge-case inputs (dry-run by default)
rt_check_http_security	MCP07	HTTP security headers (HSTS, CSP, CORS, cookies)
rt_check_callbacks	MCP02	Callback/webhook URL parameter detection
rt_check_prompt_injection	MCP03	Prompt content injection analysis
rt_check_instructions	MCP03	Server instruction poisoning detection
rt_check_tool_mutation	MCP06	Dynamic tool mutation / rug-pull detection
rt_check_rate_limiting	MCP08	Rate limiting validation
rt_check_protocol_version	MCP07	Protocol version vulnerability check

Transport Support

• stdio — Standard subprocess communication
• Streamable HTTP — Modern MCP HTTP transport
• Legacy SSE — Backward-compatible Server-Sent Events

Install

npx -y mcp-security-scanner --help

Full Changelog

See CHANGELOG.md