mcp-scanner

The server demonstrates good security practices such as using environment variables for API keys, employing Pydantic's SecretStr for sensitive data, and explicit authentication controls. The LLM analyzer uses random delimiters to mitigate prompt injection. The `stdio` server interaction carefully normalizes and validates commands using `shutil.which` and `shlex.split` before execution, which is a strong mitigation for command injection in that context. However, any interaction with external processes, especially in `stdio` mode, inherently carries risk and requires trust in the executed command. The project's documentation explicitly covers security policies and vulnerability disclosure.