Your MCP server has vulnerabilities.
Find them in 2 minutes.

Multi-layer security scans for AI-generated code and MCP servers. Detects leaked API keys, PII, prompt injection, and insecure configs.

View on GitHub
terminal
$ npx project-shield scan ./my-mcp-server 🔍 Scanning 47 files... ✗ CRITICAL F001 API Key Exposed src/config.ts:12 AKIA5EXAMPLE... Detection: regex + entropy(4.8) + context("aws_key") ✗ CRITICAL F003 Prompt Injection tools/search.ts:45 "ignore previous instructions..." Detection: keyword + structure ⚠ WARNING F002 MCP No Auth mcp.json:1 No authentication configured ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ Score: 12/100 (F) | Status: 🔒 LOCKED 2 Critical · 1 Warning · 0 Info Fix-it guide: 3 actionable fixes available Badge: Locked — resolve critical issues first

MCP is the new attack surface

AI-generated code ships fast — but security doesn't keep up. MCP servers introduce an entirely new class of vulnerabilities.

7.2%
of MCP servers have exploitable vulnerabilities
arXiv study, 1,899 servers
5.5%
contain tool poisoning patterns
Hidden instructions in tool metadata
66%
have code smells
Insecure defaults, missing auth
~45%
of AI-generated code has security flaws
Veracode 2025 report

Multi-Layer Detection

One layer misses. The next catches. Each vulnerability goes through 2–3 independent detection methods.

1

Pattern Matching

Known vulnerability signatures — regex patterns for API keys (AWS, Stripe, OpenAI…), PII formats, injection keywords, and MCP misconfigurations.

2

Entropy & Checksum

Mathematical verification — Shannon entropy analysis catches unknown key formats. Luhn algorithm validates card numbers. Checksum verifies national IDs.

3

Context Analysis

Smart filtering — variable names, file paths, and surrounding code determine if a match is a real threat or a false positive (test data, examples, comments).

3 layers for secrets · 2 layers for PII · 2 layers for injection · 5 checks for MCP

Critical vulnerability? Badge locked.

No false sense of security. If critical issues exist, your Scan Badge won't be issued until they're fixed. Fix-it guide included.

A
Excellent ✅
All checks passed
B–C
Pass ✅
Clean Scan Badge
D–E
Warning ⚠️
Badge with warning tag
F
Locked 🔒
Fix required to unlock

Not just a scan. A verifiable proof.

Every scan produces tamper-proof evidence. Clients can independently verify your security posture.

🔐

Unique Badge ID

Every Scan Badge has a UUID linked to a verification page. Anyone can check if the badge is authentic.

🔏

Hash-Sealed Results

Scan results are sealed with SHA-256 hash. Any modification is instantly detectable.

📋

Evidence Pack

Full scan metadata — timestamp, ruleset version, file count, findings summary — bundled in a verifiable package.

🛡️

Ruleset Integrity

Expert-curated rules with SHA-256 verification. Tampered rulesets are rejected before scanning begins.

Scan → Evidence → Trust

Why not just ask AI to check your security?

AI (ChatGPT / Claude) Project Shield
MCP-specific rules Generic advice Research-based rules
Detection layers Single pass Multi-layer (2–3×)
Verifiable output Chat response Sealed Evidence Pack
False positive mgmt None shield-ignore + tuned thresholds
Client proof Screenshot? Verified Scan Badge + URL

Start free. Scale when ready.

No credit card required. Scan your project today.

Free
$0
For individual developers
  • 5 scans / month
  • Terminal report
  • Watermarked Scan Badge
  • Lock system applied
  • Fix-it guide (summary)
Team
$99/mo
For teams up to 5
  • Unlimited scans
  • 5 seats
  • Dashboard
  • Slack integration
  • CI/CD gate
Enterprise
$299+/mo
Custom solutions
  • Unlimited everything
  • SSO / RBAC
  • Audit trail
  • SLA guarantee
  • Compliance mapping

Free to scan. Locked until safe.
Verified when ready.

Run your first scan in under a minute. No signup required.

npx project-shield scan .

Click to copy