cisco-ai-mcp-scanner

What it is and what it does

Cisco AI MCP Scanner is a security analysis tool for MCP (Model Context Protocol) servers and tools that combines three independent scanning engines: YARA pattern matching, LLM-as-judge behavioral analysis, and Cisco AI Defense API inspection. It detects malicious or unsafe MCP tools, scans Python dependencies for known vulnerabilities using pip-audit, analyzes source code for behavioral threats, and can scan binary files against VirusTotal's malware database. The tool runs as a standalone CLI, a REST API server via fastapi and uvicorn, or as an importable Python module, supporting multiple authentication methods including OAuth and explicit API key configuration.

The package depends on 22 runtime libraries including fastapi, uvicorn for server mode, tree-sitter language parsers for code analysis, litellm for LLM abstraction, and yara-python for pattern detection. It supports Python 3.11, 3.12, and 3.13, with low installation friction as a pure Python wheel. Configuration is environment-variable driven, allowing fine-grained control over which analyzers run and which external services are enabled.

Use it for:

• Scan MCP tools before deploying them to production to detect malicious code or unsafe patterns.
• Integrate into CI/CD pipelines to automatically check MCP server definitions and dependencies for vulnerabilities.
• Analyze source code of MCP servers for behavioral threats and production-readiness issues like missing error handling.
• Scan binary files bundled with MCP servers against VirusTotal to detect known malware signatures.
• Run offline security checks on pre-generated JSON MCP definitions in air-gapped environments.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Scans MCP (Model Context Protocol) servers and tools for security threats using YARA rules, LLM analysis, and Cisco AI Defense API, with support for CLI and REST API modes.

Yes, with conditions. Install if you need to scan MCP servers and tools for security threats and have access to at least one external API (Cisco AI Defense, an LLM provider, or VirusTotal). The package is actively maintained, has low install friction, and supports multiple independent scanning engines. However, verify the license terms first—the license treatment is unclear in the metadata—and note that most scanning modes require external API keys.

Install

cisco-ai-mcp-scanner on PyPI

pip install cisco-ai-mcp-scanner

uv add cisco-ai-mcp-scanner

poetry add cisco-ai-mcp-scanner

Installing cisco-ai-mcp-scanner

Before you install

Low friction: pure Python wheel with no compiled dependencies beyond tree-sitter language bindings. Active maintenance with recent release (7 days old) and 1032 repository stars. Requires Python 3.11.4+.

License in practice

License treatment is unclear—no SPDX identifier or raw license text provided. Verify the actual license terms in the repository before adopting in proprietary or restricted-distribution contexts.

Quickstart

pip install cisco-ai-mcp-scanner

from mcp import Client
from fastapi import FastAPI
from uvicorn import run

# Configure scanner via environment variables
# export MCP_SCANNER_API_KEY="your_key"
# Then use CLI: mcp-scanner --help

Requires Python 3.11.4 or later. Most scanning modes require external API keys (Cisco AI Defense, LLM provider, or VirusTotal) set via environment variables; offline YARA scanning may work without keys.

Verify before relying

• Whether YARA-only scanning works completely offline without any external API keys or network connectivity.
• Performance characteristics when scanning large numbers of MCP tools or servers simultaneously.
• Exact scope and coverage of the readiness scanning feature for production-readiness checks.

Package facts

Evidence: cisco_ai_mcp_scanner-4.8.3-py3-none-any.whl

Tags

More Security packages

Further reading