{"_id":"mcp-scan","_rev":"37-7ba4cc1b5f79c6074b74c05b16d48e04","name":"mcp-scan","dist-tags":{"latest":"2.0.13"},"versions":{"1.0.0":{"name":"mcp-scan","version":"1.0.0","keywords":["mcp","security","scanner","audit","model-context-protocol"],"author":{"name":"Abanoub Rodolf Boctor","email":"rodolf@thynkq.com"},"license":"MIT","_id":"mcp-scan@1.0.0","maintainers":[{"name":"rodolfboctor","email":"rodolf@thynkq.com"}],"homepage":"https://github.com/rodolfboctor/mcp-scan#readme","bugs":{"url":"https://github.com/rodolfboctor/mcp-scan/issues"},"bin":{"mcp-scan":"dist/index.js"},"dist":{"shasum":"8305be8b702b96925113c03ddc34f50ab4009c4f","tarball":"https://registry.npmjs.org/mcp-scan/-/mcp-scan-1.0.0.tgz","fileCount":5,"integrity":"sha512-lzpgxbgq3Lk3MhD/XGaD7v6xiOqzfSr8wyJ4d8nKN7Dx5gJhPv20TEFl7g7BmDAghxDHCjrU+ZzvPuHCI6XkOA==","signatures":[{"sig":"MEQCIARzOu03gR1G1bJOdFAc2LXWfW9EOfIhLn+xhMcBxuk8AiBE4RexJsSN4DcreXPujQ1PiL6Mj/GhkE7MW1Zbi9CiYQ==","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":25249},"type":"module","engines":{"node":">=18"},"gitHead":"8dcc9451eaf1b1edf352a72ad5896045223adea2","scripts":{"dev":"tsup --watch","lint":"eslint src --ext .ts","test":"vitest run","build":"tsup","test:watch":"vitest","prepublishOnly":"npm run build"},"_npmUser":{"name":"rodolfboctor","email":"rodolf@thynkq.com"},"repository":{"url":"git+https://github.com/rodolfboctor/mcp-scan.git","type":"git"},"_npmVersion":"10.9.4","description":"Security scanner for MCP servers.","directories":{},"_nodeVersion":"22.22.0","dependencies":{"ora":"^8.0.1","zod":"^3.23.8","chalk":"^5.3.0","commander":"^12.0.0","cli-table3":"^0.6.4"},"_hasShrinkwrap":false,"devDependencies":{"tsup":"^8.0.2","eslint":"^10.1.0","vitest":"^1.5.0","globals":"^17.4.0","@eslint/js":"^10.0.1","typescript":"^5.4.5","@types/node":"^20.12.7","typescript-eslint":"^8.57.1","@typescript-eslint/parser":"^8.57.1","@typescript-eslint/eslint-plugin":"^8.57.1"},"_npmOperationalInternal":{"tmp":"tmp/mcp-scan_1.0.0_1774257977118_0.3082956653479394","host":"s3://npm-registry-packages-npm-production"}},"1.0.1":{"name":"mcp-scan","version":"1.0.1","keywords":["mcp","security","scanner","audit","model-context-protocol"],"author":{"name":"Abanoub Rodolf Boctor","email":"rodolf@thynkq.com"},"license":"MIT","_id":"mcp-scan@1.0.1","maintainers":[{"name":"rodolfboctor","email":"rodolf@thynkq.com"}],"homepage":"https://github.com/rodolfboctor/mcp-scan#readme","bugs":{"url":"https://github.com/rodolfboctor/mcp-scan/issues"},"bin":{"mcp-scan":"dist/index.js"},"dist":{"shasum":"72fe9ca594df3e3169936585b160bf6d5fad8a36","tarball":"https://registry.npmjs.org/mcp-scan/-/mcp-scan-1.0.1.tgz","fileCount":5,"integrity":"sha512-SPMTxHAcHYhmSRzB2C/5p/Sv2SPUeT58XluU0/X7mjhii7lpn+UqtZ9MOkUcA/13BirMFoJsKAXgj27j57vYDg==","signatures":[{"sig":"MEQCIDd+qTDn2CFzaO9n2EO0WXMiL28h0H398dUd4FtICTe5AiAlqva1tDryk9+XfKYkqHqP7vPA1CrbQbfu9bUPndJJQQ==","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":28557},"type":"module","engines":{"node":">=18"},"gitHead":"3b647d23593b438d0f605d0ebfc7fddd1ca6c259","scripts":{"dev":"tsup --watch","lint":"eslint src --ext .ts","test":"vitest run","build":"tsup","test:watch":"vitest","prepublishOnly":"npm run build"},"_npmUser":{"name":"rodolfboctor","email":"rodolf@thynkq.com"},"repository":{"url":"git+https://github.com/rodolfboctor/mcp-scan.git","type":"git"},"_npmVersion":"10.9.4","description":"Security scanner for MCP servers.","directories":{},"_nodeVersion":"22.22.0","dependencies":{"ora":"^8.0.1","zod":"^3.23.8","chalk":"^5.3.0","commander":"^12.0.0","cli-table3":"^0.6.4"},"_hasShrinkwrap":false,"devDependencies":{"tsup":"^8.0.2","eslint":"^10.1.0","vitest":"^1.5.0","globals":"^17.4.0","@eslint/js":"^10.0.1","typescript":"^5.4.5","@types/node":"^20.12.7","typescript-eslint":"^8.57.1","@typescript-eslint/parser":"^8.57.1","@typescript-eslint/eslint-plugin":"^8.57.1"},"_npmOperationalInternal":{"tmp":"tmp/mcp-scan_1.0.1_1774285040852_0.46434384809855733","host":"s3://npm-registry-packages-npm-production"}},"1.0.2":{"name":"mcp-scan","version":"1.0.2","keywords":["mcp","security","scanner","audit","model-context-protocol"],"author":{"name":"Abanoub Rodolf Boctor","email":"rodolf@thynkq.com"},"license":"MIT","_id":"mcp-scan@1.0.2","maintainers":[{"name":"rodolfboctor","email":"rodolf@thynkq.com"}],"homepage":"https://github.com/rodolfboctor/mcp-scan#readme","bugs":{"url":"https://github.com/rodolfboctor/mcp-scan/issues"},"bin":{"mcp-scan":"dist/index.js"},"dist":{"shasum":"a35169930693a31c3b727d7d06ef884ba6a4cb17","tarball":"https://registry.npmjs.org/mcp-scan/-/mcp-scan-1.0.2.tgz","fileCount":5,"integrity":"sha512-mTqvMd87y1FXYBJsPu7tcDxOcehiVkWUpf7p9X4s2dgzMRLLLWMjO65Qd2elrR0k9i24fQz0mB1z8s7rNHCXzg==","signatures":[{"sig":"MEUCIQDe7x48posrrv22HKKpDc8exXHcQm7dGgkoWF4ZHCwPDAIgNFP3Pm0wD3xAHQxLEkf7k/CV0qTpIx81gKmUSE7xsZE=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":29207},"type":"module","engines":{"node":">=18"},"gitHead":"175bb24bd48c87b2f912b1050e2c89d0f763706f","scripts":{"dev":"tsup --watch","lint":"eslint src --ext .ts","test":"vitest run","build":"tsup","test:watch":"vitest","prepublishOnly":"npm run build"},"_npmUser":{"name":"rodolfboctor","email":"rodolf@thynkq.com"},"repository":{"url":"git+https://github.com/rodolfboctor/mcp-scan.git","type":"git"},"_npmVersion":"10.9.4","description":"Security scanner for MCP servers.","directories":{},"_nodeVersion":"22.22.0","dependencies":{"ora":"^8.0.1","zod":"^3.23.8","chalk":"^5.3.0","commander":"^12.0.0","cli-table3":"^0.6.4"},"_hasShrinkwrap":false,"devDependencies":{"tsup":"^8.0.2","eslint":"^10.1.0","vitest":"^1.5.0","globals":"^17.4.0","@eslint/js":"^10.0.1","typescript":"^5.4.5","@types/node":"^20.12.7","typescript-eslint":"^8.57.1","@typescript-eslint/parser":"^8.57.1","@typescript-eslint/eslint-plugin":"^8.57.1"},"_npmOperationalInternal":{"tmp":"tmp/mcp-scan_1.0.2_1774297793001_0.5249792204275172","host":"s3://npm-registry-packages-npm-production"}},"1.3.0":{"name":"mcp-scan","version":"1.3.0","keywords":["mcp","security","scanner","audit","model-context-protocol"],"author":{"name":"Abanoub Rodolf Boctor","email":"rodolf@thynkq.com"},"license":"MIT","_id":"mcp-scan@1.3.0","maintainers":[{"name":"rodolfboctor","email":"rodolf@thynkq.com"}],"homepage":"https://github.com/rodolfboctor/mcp-scan#readme","bugs":{"url":"https://github.com/rodolfboctor/mcp-scan/issues"},"bin":{"mcp-scan":"dist/index.js"},"dist":{"shasum":"697911c9c761fc850f5fadf1e57a054a15698958","tarball":"https://registry.npmjs.org/mcp-scan/-/mcp-scan-1.3.0.tgz","fileCount":9,"integrity":"sha512-zQJkF1OjRju7WcMNBQ7rINg0IaX8kFUrkyZrS6C2Q8ArC9wyMv5ffo1xcx6+5kJsaKOpk9giep5lRD+heeqHkA==","signatures":[{"sig":"MEUCICoDOpTg9MVRY6aH/Tf/iBUSSaywzL+lT5nH9DpjYMXOAiEAhdLmzZ6YZvG9cBqYhvgyt99We7IVNhjRm3DujlkUg/Y=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":592410},"main":"./dist/lib.js","type":"module","types":"./dist/lib.d.ts","module":"./dist/lib.js","engines":{"node":">=18"},"exports":{".":{"types":"./dist/lib.d.ts","import":"./dist/lib.js","require":"./dist/lib.cjs"}},"gitHead":"c9a4e0ee6fc6f2c8082a0462c3c4795ea749b5ad","scripts":{"dev":"tsup --watch","lint":"eslint src --ext .ts","test":"vitest run","build":"tsup","test:watch":"vitest","prepublishOnly":"npm run build"},"_npmUser":{"name":"rodolfboctor","email":"rodolf@thynkq.com"},"repository":{"url":"git+https://github.com/rodolfboctor/mcp-scan.git","type":"git"},"_npmVersion":"10.9.4","description":"Security scanner for MCP servers.","directories":{},"_nodeVersion":"22.22.0","dependencies":{"ora":"^8.0.1","zod":"^3.23.8","chalk":"^5.3.0","commander":"^12.0.0","fast-glob":"^3.3.3","smol-toml":"^1.6.1","cli-table3":"^0.6.4"},"_hasShrinkwrap":false,"devDependencies":{"tsup":"^8.0.2","execa":"^9.6.1","eslint":"^10.1.0","vitest":"^1.5.0","globals":"^17.4.0","@eslint/js":"^10.0.1","typescript":"^5.4.5","vuln-vects":"^1.1.0","@types/node":"^20.12.7","typescript-eslint":"^8.57.1","@typescript-eslint/parser":"^8.57.1","@typescript-eslint/eslint-plugin":"^8.57.1"},"_npmOperationalInternal":{"tmp":"tmp/mcp-scan_1.3.0_1774334660999_0.5930897100036994","host":"s3://npm-registry-packages-npm-production"}},"1.5.0":{"name":"mcp-scan","version":"1.5.0","keywords":["mcp","security","scanner","audit","model-context-protocol"],"author":{"name":"Abanoub Rodolf Boctor","email":"rodolf@thynkq.com"},"license":"MIT","_id":"mcp-scan@1.5.0","maintainers":[{"name":"rodolfboctor","email":"rodolf@thynkq.com"}],"homepage":"https://github.com/rodolfboctor/mcp-scan#readme","bugs":{"url":"https://github.com/rodolfboctor/mcp-scan/issues"},"bin":{"mcp-scan":"dist/index.js"},"dist":{"shasum":"011aa7753513b2ee0055ccaf515fb829ea5a7cd3","tarball":"https://registry.npmjs.org/mcp-scan/-/mcp-scan-1.5.0.tgz","fileCount":11,"integrity":"sha512-I1b71zLa6fcHsvdK3aHNuaphtEsVey+iJ+EezFmbU9BIb5/jXNFRT8UIQjY5iMze5dGlDXXd9Cy5mSjAqZNwxw==","signatures":[{"sig":"MEYCIQDCL/L2JgFQsBr3Fn/OQORGdQ9sLSDkyKuZkbveLVwdAQIhAPNI52Epe9xzAorurfdKIma5ByWMeCG1DpccgUnf/vDj","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":781616},"main":"./dist/lib.js","type":"module","types":"./dist/lib.d.ts","module":"./dist/lib.js","engines":{"node":">=18"},"exports":{".":{"types":"./dist/lib.d.ts","import":"./dist/lib.js","require":"./dist/lib.cjs"}},"gitHead":"32824f4f25ce5e20d54d5f0ebd3147214fa9cd06","scripts":{"dev":"tsup --watch","lint":"eslint src --ext .ts","test":"vitest run","build":"tsup","test:watch":"vitest","build:action":"tsup --config tsup.config.ts","prepublishOnly":"npm run build"},"_npmUser":{"name":"rodolfboctor","email":"rodolf@thynkq.com"},"repository":{"url":"git+https://github.com/rodolfboctor/mcp-scan.git","type":"git"},"_npmVersion":"10.9.4","description":"Security scanner for MCP servers.","directories":{},"_nodeVersion":"22.22.0","dependencies":{"ora":"^8.0.1","zod":"^3.23.8","chalk":"^5.3.0","commander":"^12.0.0","fast-glob":"^3.3.3","smol-toml":"^1.6.1","cli-table3":"^0.6.4"},"_hasShrinkwrap":false,"devDependencies":{"tsup":"^8.0.2","execa":"^9.6.1","eslint":"^10.1.0","vitest":"^1.5.0","globals":"^17.4.0","@eslint/js":"^10.0.1","typescript":"^5.4.5","vuln-vects":"^1.1.0","@types/node":"^20.12.7","@actions/core":"^3.0.0","typescript-eslint":"^8.57.1","@typescript-eslint/parser":"^8.57.1","@typescript-eslint/eslint-plugin":"^8.57.1"},"_npmOperationalInternal":{"tmp":"tmp/mcp-scan_1.5.0_1774336383770_0.7566265827266856","host":"s3://npm-registry-packages-npm-production"}},"1.7.1":{"name":"mcp-scan","version":"1.7.1","keywords":["mcp","security","scanner","audit","model-context-protocol"],"author":{"name":"Abanoub Rodolf Boctor","email":"rodolf@thynkq.com"},"license":"MIT","_id":"mcp-scan@1.7.1","maintainers":[{"name":"rodolfboctor","email":"rodolf@thynkq.com"}],"homepage":"https://github.com/rodolfboctor/mcp-scan#readme","bugs":{"url":"https://github.com/rodolfboctor/mcp-scan/issues"},"bin":{"mcp-scan":"dist/index.js"},"dist":{"shasum":"375da7ebe1cd100d90fdda106a8a695c9c269463","tarball":"https://registry.npmjs.org/mcp-scan/-/mcp-scan-1.7.1.tgz","fileCount":32,"integrity":"sha512-ZlzF9aW9NDgIXdI55jCQ/EKnZaqLpv2dbudAoSdL6MXduXAfYQPgyQdAn9nWEMlxsA8nS9SeWlbUWeamXH9rdQ==","signatures":[{"sig":"MEUCIDk+tjqOsupa9RK4sShQ4o1TW+uNF3GZF0submoRKuuDAiEAkyEJYcJLsqu62j2QD2ECLyDvQCbU9Iwx1i+yoQZgHhU=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":1079212},"main":"./dist/lib.js","type":"module","types":"./dist/lib.d.ts","module":"./dist/lib.js","engines":{"node":">=18"},"exports":{".":{"types":"./dist/lib.d.ts","import":"./dist/lib.js","require":"./dist/lib.cjs"}},"gitHead":"b6b3c780dfc2560600c3d239b7d196bce012a914","scripts":{"dev":"tsup --watch","lint":"eslint src --ext .ts","test":"vitest run","build":"tsup && node -e \"const{cpSync,mkdirSync}=require('fs');mkdirSync('data',{recursive:true});cpSync('src/data/cve-snapshot.json','data/cve-snapshot.json');\"","test:watch":"vitest","build:action":"tsup --config tsup.config.ts","prepublishOnly":"npm run build","update-cve-snapshot":"npx tsx src/scripts/update-cve-snapshot.ts"},"_npmUser":{"name":"rodolfboctor","email":"rodolf@thynkq.com"},"repository":{"url":"git+https://github.com/rodolfboctor/mcp-scan.git","type":"git"},"_npmVersion":"10.9.4","description":"Security scanner for MCP servers.","directories":{},"_nodeVersion":"22.22.0","dependencies":{"ora":"^8.0.1","zod":"^3.23.8","uuid":"^13.0.0","chalk":"^5.3.0","semver":"^7.7.4","blessed":"^0.1.81","commander":"^12.0.0","fast-glob":"^3.3.3","smol-toml":"^1.6.1","cli-table3":"^0.6.4","blessed-contrib":"^4.11.0"},"_hasShrinkwrap":false,"devDependencies":{"tsup":"^8.0.2","execa":"^9.6.1","eslint":"^10.1.0","vitest":"^1.5.0","globals":"^17.4.0","@eslint/js":"^10.0.1","typescript":"^5.4.5","vuln-vects":"^1.1.0","@types/node":"^20.12.7","@types/uuid":"^10.0.0","@actions/core":"^3.0.0","@types/semver":"^7.7.1","@types/blessed":"^0.1.27","typescript-eslint":"^8.57.1","@typescript-eslint/parser":"^8.57.1","@typescript-eslint/eslint-plugin":"^8.57.1"},"_npmOperationalInternal":{"tmp":"tmp/mcp-scan_1.7.1_1774389424224_0.03951184858199008","host":"s3://npm-registry-packages-npm-production"}},"1.7.2":{"name":"mcp-scan","version":"1.7.2","keywords":["mcp","security","scanner","audit","model-context-protocol"],"author":{"name":"Abanoub Rodolf Boctor","email":"rodolf@thynkq.com"},"license":"MIT","_id":"mcp-scan@1.7.2","maintainers":[{"name":"rodolfboctor","email":"rodolf@thynkq.com"}],"homepage":"https://github.com/rodolfboctor/mcp-scan#readme","bugs":{"url":"https://github.com/rodolfboctor/mcp-scan/issues"},"bin":{"mcp-scan":"dist/index.js"},"dist":{"shasum":"35e3268c55fd88b0288171f870f0d7b8ce3be16b","tarball":"https://registry.npmjs.org/mcp-scan/-/mcp-scan-1.7.2.tgz","fileCount":32,"integrity":"sha512-uVPxegc1ltg0NYGHwWVA+U55itxfSu0MX5ZHEMRJbsQlx3cLquQUed93ET3AdL7DTiJXm7u647g0/Nz6jpjlQw==","signatures":[{"sig":"MEYCIQD1++FuwMoMiw4ty5NgXTGLL8yXhU+uL8tdDKkBWTy6twIhAJi76HaG5xvVUofbD5nf4+DrHAfiqq0UNjr9VRWEa2uC","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":1079258},"main":"./dist/lib.js","type":"module","types":"./dist/lib.d.ts","module":"./dist/lib.js","engines":{"node":">=18"},"exports":{".":{"types":"./dist/lib.d.ts","import":"./dist/lib.js","require":"./dist/lib.cjs"}},"gitHead":"92059df7224a20bb4cf16005f13f12c97adca680","scripts":{"dev":"tsup --watch","lint":"eslint src --ext .ts","test":"vitest run","build":"tsup && node -e \"const{cpSync,mkdirSync}=require('fs');mkdirSync('data',{recursive:true});cpSync('src/data/cve-snapshot.json','data/cve-snapshot.json');\"","test:watch":"vitest","build:action":"tsup --config tsup.config.ts","prepublishOnly":"npm run build","update-cve-snapshot":"npx tsx src/scripts/update-cve-snapshot.ts"},"_npmUser":{"name":"rodolfboctor","email":"rodolf@thynkq.com"},"overrides":{"xml2js":">=0.5.0"},"repository":{"url":"git+https://github.com/rodolfboctor/mcp-scan.git","type":"git"},"_npmVersion":"10.9.4","description":"Security scanner for MCP servers.","directories":{},"_nodeVersion":"22.22.0","dependencies":{"ora":"^8.0.1","zod":"^3.23.8","uuid":"^13.0.0","chalk":"^5.3.0","semver":"^7.7.4","blessed":"^0.1.81","commander":"^12.0.0","fast-glob":"^3.3.3","smol-toml":"^1.6.1","cli-table3":"^0.6.4","blessed-contrib":"^4.11.0"},"_hasShrinkwrap":false,"devDependencies":{"tsup":"^8.0.2","execa":"^9.6.1","eslint":"^10.1.0","vitest":"^4.1.1","globals":"^17.4.0","@eslint/js":"^10.0.1","typescript":"^5.4.5","vuln-vects":"^1.1.0","@types/node":"^20.12.7","@types/uuid":"^10.0.0","@actions/core":"^3.0.0","@types/semver":"^7.7.1","@types/blessed":"^0.1.27","typescript-eslint":"^8.57.1","@typescript-eslint/parser":"^8.57.1","@typescript-eslint/eslint-plugin":"^8.57.1"},"_npmOperationalInternal":{"tmp":"tmp/mcp-scan_1.7.2_1774390020410_0.5554629486424967","host":"s3://npm-registry-packages-npm-production"}},"1.7.3":{"name":"mcp-scan","version":"1.7.3","keywords":["mcp","security","scanner","audit","model-context-protocol"],"author":{"name":"Abanoub Rodolf Boctor","email":"rodolf@thynkq.com"},"license":"MIT","_id":"mcp-scan@1.7.3","maintainers":[{"name":"rodolfboctor","email":"rodolf@thynkq.com"}],"homepage":"https://github.com/rodolfboctor/mcp-scan#readme","bugs":{"url":"https://github.com/rodolfboctor/mcp-scan/issues"},"bin":{"mcp-scan":"dist/index.js"},"dist":{"shasum":"58f5f784f8408eb842105e23cd95c7b40267fdbf","tarball":"https://registry.npmjs.org/mcp-scan/-/mcp-scan-1.7.3.tgz","fileCount":32,"integrity":"sha512-RPDHXv05eYs0FqHRnUob1chf5TFO5GK7wO0d9nzb8QnZ96gkDdLcj6h1NJEMAB0tHGyja1+/o0DC9uYOhMRQag==","signatures":[{"sig":"MEUCIGwM+mpVAME5r0xZhRAyOwI36JXs5JDVDZ6mL+O+8dzjAiEA43KAlyrshEMHHFDj+AOXrh6gTUEwfvdo7Fv/HvbhpRU=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":1079167},"main":"./dist/lib.js","type":"module","types":"./dist/lib.d.ts","module":"./dist/lib.js","engines":{"node":">=18"},"exports":{".":{"types":"./dist/lib.d.ts","import":"./dist/lib.js","require":"./dist/lib.cjs"}},"gitHead":"086b963eff8adfce589193edefd8d2042fe56eab","scripts":{"dev":"tsup --watch","lint":"eslint src --ext .ts","test":"vitest run","build":"tsup && node -e \"const{cpSync,mkdirSync}=require('fs');mkdirSync('data',{recursive:true});cpSync('src/data/cve-snapshot.json','data/cve-snapshot.json');\"","test:watch":"vitest","build:action":"tsup --config tsup.config.ts","prepublishOnly":"npm run build","update-cve-snapshot":"npx tsx src/scripts/update-cve-snapshot.ts"},"_npmUser":{"name":"rodolfboctor","email":"rodolf@thynkq.com"},"overrides":{"xml2js":">=0.5.0"},"repository":{"url":"git+https://github.com/rodolfboctor/mcp-scan.git","type":"git"},"_npmVersion":"10.9.4","description":"Security scanner for MCP servers.","directories":{},"_nodeVersion":"22.22.0","dependencies":{"ora":"^8.0.1","zod":"^3.23.8","uuid":"^13.0.0","chalk":"^5.3.0","semver":"^7.7.4","blessed":"^0.1.81","commander":"^12.0.0","fast-glob":"^3.3.3","smol-toml":"^1.6.1","cli-table3":"^0.6.4","blessed-contrib":"^4.11.0"},"_hasShrinkwrap":false,"devDependencies":{"tsup":"^8.0.2","execa":"^9.6.1","eslint":"^10.1.0","vitest":"^4.1.1","globals":"^17.4.0","@eslint/js":"^10.0.1","typescript":"^5.4.5","vuln-vects":"^1.1.0","@types/node":"^20.12.7","@types/uuid":"^10.0.0","@actions/core":"^3.0.0","@types/semver":"^7.7.1","@types/blessed":"^0.1.27","typescript-eslint":"^8.57.1","@typescript-eslint/parser":"^8.57.1","@typescript-eslint/eslint-plugin":"^8.57.1"},"_npmOperationalInternal":{"tmp":"tmp/mcp-scan_1.7.3_1774390905151_0.2937439539945743","host":"s3://npm-registry-packages-npm-production"}},"1.7.5":{"name":"mcp-scan","version":"1.7.5","keywords":["mcp","security","scanner","audit","model-context-protocol"],"author":{"name":"Abanoub Rodolf Boctor","email":"rodolf@thynkq.com"},"license":"MIT","_id":"mcp-scan@1.7.5","maintainers":[{"name":"rodolfboctor","email":"rodolf@thynkq.com"}],"homepage":"https://github.com/rodolfboctor/mcp-scan#readme","bugs":{"url":"https://github.com/rodolfboctor/mcp-scan/issues"},"bin":{"mcp-scan":"dist/index.js"},"dist":{"shasum":"d395d0bec256c3ecb50e2896d9d1b3448f511974","tarball":"https://registry.npmjs.org/mcp-scan/-/mcp-scan-1.7.5.tgz","fileCount":32,"integrity":"sha512-9haseB/OlCU0CO6kHHUX0w6k5npoTzn8zQwO7CZnr68A1E6yCr73p2c+9PjjYRPn3akmUL4/JuMZDB2/O6RVTA==","signatures":[{"sig":"MEUCIGJsTfEUduxfvaJpX35bd4gkWm39sdphL5qu+BtfFVmBAiEAyTFZnI2OfSr+14ANlHp46ZkAwDoL+yedDLH+WvbRYzE=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":1087378},"main":"./dist/lib.js","type":"module","types":"./dist/lib.d.ts","module":"./dist/lib.js","engines":{"node":">=18"},"exports":{".":{"types":"./dist/lib.d.ts","import":"./dist/lib.js","require":"./dist/lib.cjs"}},"gitHead":"eed4418a4eea389589d6b3b2da8dfb2cc5f6df46","scripts":{"dev":"tsup --watch","lint":"eslint src --ext .ts","test":"vitest run","build":"tsup && node -e \"const{cpSync,mkdirSync}=require('fs');mkdirSync('data',{recursive:true});cpSync('src/data/cve-snapshot.json','data/cve-snapshot.json');\"","test:watch":"vitest","build:action":"tsup --config tsup.config.ts","prepublishOnly":"npm run build","update-cve-snapshot":"npx tsx src/scripts/update-cve-snapshot.ts"},"_npmUser":{"name":"rodolfboctor","email":"rodolf@thynkq.com"},"overrides":{"xml2js":">=0.5.0"},"repository":{"url":"git+https://github.com/rodolfboctor/mcp-scan.git","type":"git"},"_npmVersion":"10.9.4","description":"Security scanner for MCP servers.","directories":{},"_nodeVersion":"22.22.0","dependencies":{"ora":"^8.0.1","zod":"^3.23.8","uuid":"^13.0.0","chalk":"^5.3.0","semver":"^7.7.4","blessed":"^0.1.81","commander":"^12.0.0","fast-glob":"^3.3.3","smol-toml":"^1.6.1","cli-table3":"^0.6.4","blessed-contrib":"^4.11.0"},"_hasShrinkwrap":false,"devDependencies":{"tsup":"^8.0.2","execa":"^9.6.1","eslint":"^10.1.0","vitest":"^4.1.1","globals":"^17.4.0","@eslint/js":"^10.0.1","typescript":"^5.4.5","vuln-vects":"^1.1.0","@types/node":"^20.12.7","@types/uuid":"^10.0.0","@actions/core":"^3.0.0","@types/semver":"^7.7.1","@types/blessed":"^0.1.27","typescript-eslint":"^8.57.1","@vitest/coverage-v8":"^4.1.1","@typescript-eslint/parser":"^8.57.1","@typescript-eslint/eslint-plugin":"^8.57.1"},"_npmOperationalInternal":{"tmp":"tmp/mcp-scan_1.7.5_1774483071558_0.14940379024167383","host":"s3://npm-registry-packages-npm-production"}},"1.7.6":{"name":"mcp-scan","version":"1.7.6","keywords":["mcp","security","scanner","audit","model-context-protocol"],"author":{"name":"Abanoub Rodolf Boctor","email":"rodolf@thynkq.com"},"license":"MIT","_id":"mcp-scan@1.7.6","maintainers":[{"name":"rodolfboctor","email":"rodolf@thynkq.com"}],"homepage":"https://thynkq.com/products/mcp-scan","bugs":{"url":"https://github.com/rodolfboctor/mcp-scan/issues"},"bin":{"mcp-scan":"dist/index.js"},"dist":{"shasum":"d83e0fb2d9483e60b1753c1409d07f0eb1f402a6","tarball":"https://registry.npmjs.org/mcp-scan/-/mcp-scan-1.7.6.tgz","fileCount":32,"integrity":"sha512-AMaHbNCVPrn1qQOxqvwXV5HgdKooupwbYTkKRLlz7eJjlXsHTrHqHnyxcwE5RejCxsfUMl2i2BXwnjVEXUaNaw==","signatures":[{"sig":"MEUCIQCsIbx49gTx9uQ4bpQgxlQynyAxZaQ7vlQncNKsb88VbgIgWmTsP3UXGKtcryRoUX9k65XAU4212GvAo3YojnLNgQk=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":1087367},"main":"./dist/lib.js","type":"module","types":"./dist/lib.d.ts","module":"./dist/lib.js","engines":{"node":">=18"},"exports":{".":{"types":"./dist/lib.d.ts","import":"./dist/lib.js","require":"./dist/lib.cjs"}},"gitHead":"b37763436b0f581599246b899b86d553981a6b11","scripts":{"dev":"tsup --watch","lint":"eslint src --ext .ts","test":"vitest run","build":"tsup && node -e \"const{cpSync,mkdirSync}=require('fs');mkdirSync('data',{recursive:true});cpSync('src/data/cve-snapshot.json','data/cve-snapshot.json');\"","test:watch":"vitest","build:action":"tsup --config tsup.config.ts","prepublishOnly":"npm run build","update-cve-snapshot":"npx tsx src/scripts/update-cve-snapshot.ts"},"_npmUser":{"name":"rodolfboctor","email":"rodolf@thynkq.com"},"overrides":{"xml2js":">=0.5.0"},"repository":{"url":"git+https://github.com/rodolfboctor/mcp-scan.git","type":"git"},"_npmVersion":"10.9.4","description":"Security scanner for MCP servers.","directories":{},"_nodeVersion":"22.22.0","dependencies":{"ora":"^8.0.1","zod":"^3.23.8","uuid":"^13.0.0","chalk":"^5.3.0","semver":"^7.7.4","blessed":"^0.1.81","commander":"^12.0.0","fast-glob":"^3.3.3","smol-toml":"^1.6.1","cli-table3":"^0.6.4","blessed-contrib":"^4.11.0"},"_hasShrinkwrap":false,"devDependencies":{"tsup":"^8.0.2","execa":"^9.6.1","eslint":"^10.1.0","vitest":"^4.1.1","globals":"^17.4.0","@eslint/js":"^10.0.1","typescript":"^5.4.5","vuln-vects":"^1.1.0","@types/node":"^20.12.7","@types/uuid":"^10.0.0","@actions/core":"^3.0.0","@types/semver":"^7.7.1","@types/blessed":"^0.1.27","typescript-eslint":"^8.57.1","@vitest/coverage-v8":"^4.1.1","@typescript-eslint/parser":"^8.57.1","@typescript-eslint/eslint-plugin":"^8.57.1"},"_npmOperationalInternal":{"tmp":"tmp/mcp-scan_1.7.6_1774490889465_0.7686521625916656","host":"s3://npm-registry-packages-npm-production"}},"2.0.0":{"name":"mcp-scan","version":"2.0.0","keywords":["mcp","security","scanner","audit","model-context-protocol"],"author":{"name":"Abanoub Rodolf Boctor","email":"rodolf@thynkq.com"},"license":"MIT","_id":"mcp-scan@2.0.0","maintainers":[{"name":"rodolfboctor","email":"rodolf@thynkq.com"}],"homepage":"https://thynkq.com/products/mcp-scan","bugs":{"url":"https://github.com/rodolfboctor/mcp-scan/issues"},"bin":{"mcp-scan":"dist/index.js"},"dist":{"shasum":"87bcc8defde34bd4a37898c26fc1a449a822cc90","tarball":"https://registry.npmjs.org/mcp-scan/-/mcp-scan-2.0.0.tgz","fileCount":38,"integrity":"sha512-YbBBGehIO4vI4/uwkrGVRJXZyj3u1104DmfGUvPlLXi5gkW0PoXg63Bp7Q85SCx2Qxb5PJv2CYlIcfJugXr4rA==","signatures":[{"sig":"MEUCIQD886TTN1gW1HX1msWPafVrVFpkRKBPYPohP6Pnjn9S0QIgH/DDfQBmcl2GYCxAGqpl3QpnM3CqytFfx/ksvDhajss=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":1123921},"main":"./dist/lib.js","type":"module","types":"./dist/lib.d.ts","module":"./dist/lib.js","engines":{"node":">=18"},"exports":{".":{"types":"./dist/lib.d.ts","import":"./dist/lib.js","require":"./dist/lib.cjs"}},"gitHead":"774e73334fc687d10098c84b1ceef7a54118a8d1","scripts":{"dev":"tsup --watch","lint":"eslint src --ext .ts","test":"vitest run","build":"tsup && node -e \"const{cpSync,mkdirSync}=require('fs');mkdirSync('data',{recursive:true});cpSync('src/data/cve-snapshot.json','data/cve-snapshot.json');\"","test:watch":"vitest","build:action":"tsup --config tsup.config.ts","prepublishOnly":"npm run build","update-cve-snapshot":"npx tsx src/scripts/update-cve-snapshot.ts"},"_npmUser":{"name":"rodolfboctor","email":"rodolf@thynkq.com"},"overrides":{"xml2js":">=0.5.0"},"repository":{"url":"git+https://github.com/rodolfboctor/mcp-scan.git","type":"git"},"_npmVersion":"10.9.4","description":"Security scanner for MCP servers.","directories":{},"_nodeVersion":"22.22.0","dependencies":{"ora":"^8.0.1","zod":"^3.23.8","uuid":"^13.0.0","yaml":"^2.8.3","chalk":"^5.3.0","semver":"^7.7.4","blessed":"^0.1.81","commander":"^12.0.0","fast-glob":"^3.3.3","smol-toml":"^1.6.1","cli-table3":"^0.6.4","blessed-contrib":"^4.11.0"},"_hasShrinkwrap":false,"devDependencies":{"tsup":"^8.0.2","execa":"^9.6.1","eslint":"^10.1.0","vitest":"^4.1.1","globals":"^17.4.0","@eslint/js":"^10.0.1","typescript":"^5.4.5","vuln-vects":"^1.1.0","@types/node":"^20.12.7","@types/uuid":"^10.0.0","@actions/core":"^3.0.0","@types/semver":"^7.7.1","@types/blessed":"^0.1.27","typescript-eslint":"^8.57.1","@vitest/coverage-v8":"^4.1.1","@typescript-eslint/parser":"^8.57.1","@typescript-eslint/eslint-plugin":"^8.57.1"},"_npmOperationalInternal":{"tmp":"tmp/mcp-scan_2.0.0_1774673435215_0.8923173548006096","host":"s3://npm-registry-packages-npm-production"}},"2.0.1":{"name":"mcp-scan","version":"2.0.1","keywords":["mcp","security","scanner","audit","model-context-protocol","mcp-scan","mcp-security","mcp-server","claude-desktop","cursor","vscode","windsurf","ai-security","llm-security","prompt-injection","supply-chain-security","secret-detection","typosquatting","data-flow-analysis","sarif","github-action","cli","devtools","security-audit","vulnerability-scanner"],"author":{"name":"Abanoub Rodolf Boctor","email":"rodolf@thynkq.com"},"license":"MIT","_id":"mcp-scan@2.0.1","maintainers":[{"name":"rodolfboctor","email":"rodolf@thynkq.com"}],"homepage":"https://thynkq.com/products/mcp-scan","bugs":{"url":"https://github.com/rodolfboctor/mcp-scan/issues"},"bin":{"mcp-scan":"dist/index.js"},"dist":{"shasum":"8963fcccd707f0880bd21ac5b84a0086deacebcc","tarball":"https://registry.npmjs.org/mcp-scan/-/mcp-scan-2.0.1.tgz","fileCount":38,"integrity":"sha512-4xxA0v3fI7n+pzumDAa23nYsfu1wCw7rAqMEt79yDbSv7RvwSNFcK4PqxVMX6YUGq6OKpl57fOkcVkukJ8jTog==","signatures":[{"sig":"MEUCIQC6ai/uTvmkMcmxNqF5JXv4MmHmkKjx6VRPQIavSnA47gIgDFEaEGJQ7+Lg8KLYv2oUIgN9GKf6YOpsbgok+ojWNaY=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":1128335},"main":"./dist/lib.js","type":"module","types":"./dist/lib.d.ts","module":"./dist/lib.js","engines":{"node":">=18"},"exports":{".":{"types":"./dist/lib.d.ts","import":"./dist/lib.js","require":"./dist/lib.cjs"}},"gitHead":"baacc7cf8f6f3a7817172dc25d67996704614eb5","scripts":{"dev":"tsup --watch","lint":"eslint src --ext .ts","test":"vitest run","build":"tsup && node -e \"const{cpSync,mkdirSync}=require('fs');mkdirSync('data',{recursive:true});cpSync('src/data/cve-snapshot.json','data/cve-snapshot.json');\"","test:watch":"vitest","build:action":"tsup --config tsup.config.ts","prepublishOnly":"npm run build","update-cve-snapshot":"npx tsx src/scripts/update-cve-snapshot.ts"},"_npmUser":{"name":"rodolfboctor","email":"rodolf@thynkq.com"},"overrides":{"xml2js":">=0.5.0"},"repository":{"url":"git+https://github.com/rodolfboctor/mcp-scan.git","type":"git"},"_npmVersion":"10.9.4","description":"Open-source security scanner for Model Context Protocol (MCP) servers. Audits Claude Desktop, VS Code, Cursor, Windsurf, and 16+ AI tools for secrets, prompt injection, supply-chain risks, and 17+ security checks.","directories":{},"_nodeVersion":"22.22.0","dependencies":{"ora":"^8.0.1","zod":"^3.23.8","uuid":"^13.0.0","yaml":"^2.8.3","chalk":"^5.3.0","semver":"^7.7.4","blessed":"^0.1.81","commander":"^12.0.0","fast-glob":"^3.3.3","smol-toml":"^1.6.1","cli-table3":"^0.6.4","blessed-contrib":"^4.11.0"},"_hasShrinkwrap":false,"devDependencies":{"tsup":"^8.0.2","execa":"^9.6.1","eslint":"^10.1.0","vitest":"^4.1.1","globals":"^17.4.0","@eslint/js":"^10.0.1","typescript":"^5.4.5","vuln-vects":"^1.1.0","@types/node":"^20.12.7","@types/uuid":"^10.0.0","@actions/core":"^3.0.0","@types/semver":"^7.7.1","@types/blessed":"^0.1.27","typescript-eslint":"^8.57.1","@vitest/coverage-v8":"^4.1.1","@typescript-eslint/parser":"^8.57.1","@typescript-eslint/eslint-plugin":"^8.57.1"},"_npmOperationalInternal":{"tmp":"tmp/mcp-scan_2.0.1_1774730881285_0.22260060900456624","host":"s3://npm-registry-packages-npm-production"}},"2.0.2":{"name":"mcp-scan","version":"2.0.2","keywords":["mcp","security","scanner","audit","model-context-protocol","mcp-scan","mcp-security","mcp-server","claude-desktop","cursor","vscode","windsurf","ai-security","llm-security","prompt-injection","supply-chain-security","secret-detection","typosquatting","data-flow-analysis","sarif","github-action","cli","devtools","security-audit","vulnerability-scanner"],"author":{"name":"Abanoub Rodolf Boctor","email":"rodolf@thynkq.com"},"license":"MIT","_id":"mcp-scan@2.0.2","maintainers":[{"name":"rodolfboctor","email":"rodolf@thynkq.com"}],"homepage":"https://thynkq.com/products/mcp-scan","bugs":{"url":"https://gitlab.com/abanoub.rodolf/mcp-scan/-/issues"},"bin":{"mcp-scan":"dist/index.js"},"dist":{"shasum":"16ddeaea78e5f5bf0eceb07d92650a2484c277f0","tarball":"https://registry.npmjs.org/mcp-scan/-/mcp-scan-2.0.2.tgz","fileCount":38,"integrity":"sha512-uXXusN8wJKOqm//QTH4o3FlpzKR6T5475XLYRnFdlkFXSzNezMrVldkFxKF8UccbLrG2nAkJPyJLJNt3GAMdgw==","signatures":[{"sig":"MEUCIQDwmPJX0BAUfx2ZWCXqS0O8KG1G+85obyvOWJwRvG6P6wIgeEF9GEwvYOyeWWfkVWfFXptESXybq3DXhGwvdOxo/LE=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":1209909},"main":"./dist/lib.js","type":"module","types":"./dist/lib.d.ts","module":"./dist/lib.js","engines":{"node":">=18"},"exports":{".":{"types":"./dist/lib.d.ts","import":"./dist/lib.js","require":"./dist/lib.cjs"}},"gitHead":"48ada5927413c7afebb6c2746ecc82286f97bcd2","scripts":{"dev":"tsup --watch","lint":"eslint src --ext .ts","test":"vitest run","build":"tsup && node -e \"const{cpSync,mkdirSync}=require('fs');mkdirSync('data',{recursive:true});cpSync('src/data/cve-snapshot.json','data/cve-snapshot.json');\"","test:watch":"vitest","build:action":"tsup --config tsup.config.ts","prepublishOnly":"npm run build","update-cve-snapshot":"npx tsx src/scripts/update-cve-snapshot.ts"},"_npmUser":{"name":"rodolfboctor","email":"rodolf@thynkq.com"},"overrides":{"lodash":"4.17.21","xml2js":">=0.5.0"},"repository":{"url":"git+https://gitlab.com/abanoub.rodolf/mcp-scan.git","type":"git"},"_npmVersion":"10.9.4","description":"Open-source security scanner for Model Context Protocol (MCP) servers. Audits Claude Desktop, VS Code, Cursor, Windsurf, and 16+ AI tools for secrets, prompt injection, supply-chain risks, and 17+ security checks.","directories":{},"_nodeVersion":"22.22.0","dependencies":{"ora":"^8.0.1","zod":"^3.23.8","uuid":"^13.0.0","yaml":"^2.8.3","chalk":"^5.3.0","semver":"^7.7.4","blessed":"^0.1.81","commander":"^12.0.0","fast-glob":"^3.3.3","smol-toml":"^1.6.1","cli-table3":"^0.6.4","blessed-contrib":"^4.11.0"},"_hasShrinkwrap":false,"devDependencies":{"tsup":"^8.0.2","execa":"^9.6.1","eslint":"^10.1.0","vitest":"^4.1.1","globals":"^17.4.0","@eslint/js":"^10.0.1","typescript":"^5.4.5","vuln-vects":"^1.1.0","@types/node":"^20.12.7","@types/uuid":"^10.0.0","@actions/core":"^3.0.0","@types/semver":"^7.7.1","@types/blessed":"^0.1.27","typescript-eslint":"^8.57.1","@vitest/coverage-v8":"^4.1.1","@typescript-eslint/parser":"^8.57.1","@typescript-eslint/eslint-plugin":"^8.57.1"},"_npmOperationalInternal":{"tmp":"tmp/mcp-scan_2.0.2_1777319342501_0.3125488358374062","host":"s3://npm-registry-packages-npm-production"}},"2.0.3":{"name":"mcp-scan","version":"2.0.3","keywords":["mcp","security","scanner","audit","model-context-protocol","mcp-scan","mcp-security","mcp-server","claude-desktop","cursor","vscode","windsurf","ai-security","llm-security","prompt-injection","supply-chain-security","secret-detection","typosquatting","data-flow-analysis","sarif","github-action","cli","devtools","security-audit","vulnerability-scanner"],"author":{"name":"Abanoub Rodolf Boctor","email":"rodolf@thynkq.com"},"license":"MIT","_id":"mcp-scan@2.0.3","maintainers":[{"name":"rodolfboctor","email":"rodolf@thynkq.com"}],"homepage":"https://thynkq.com/products/mcp-scan","bugs":{"url":"https://github.com/Abanoub-Rodolf/mcp-scan/issues"},"bin":{"mcp-scan":"dist/index.js"},"dist":{"shasum":"adf3c3d5264284621b403db104b5884f40d1b738","tarball":"https://registry.npmjs.org/mcp-scan/-/mcp-scan-2.0.3.tgz","fileCount":38,"integrity":"sha512-3nz2WN4NbZ3gjyh8SVEml83VMBHdivAjvcZjDYJIg3uz+FkIeaS0mvx8/jT7SygXW2wisyNcsyKLK3wJqHilhw==","signatures":[{"sig":"MEQCID/YBS5FrU3w8v9y+LL6hv5P+HBLUS1vQbSZiK0jI0N2AiAR6AgWZJF3ZrcuJu3ISPnMgGeoeGp66X5/HQG06nryeQ==","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"attestations":{"url":"https://registry.npmjs.org/-/npm/v1/attestations/mcp-scan@2.0.3","provenance":{"predicateType":"https://slsa.dev/provenance/v1"}},"unpackedSize":1457862},"main":"./dist/lib.js","type":"module","types":"./dist/lib.d.ts","module":"./dist/lib.js","engines":{"node":">=18"},"exports":{".":{"types":"./dist/lib.d.ts","import":"./dist/lib.js","require":"./dist/lib.cjs"}},"gitHead":"9b539ef4e7cb6758f23b529b0af7cb4783b945e4","scripts":{"dev":"tsup --watch","lint":"eslint src --ext .ts","test":"vitest run","build":"tsup && node -e \"const{cpSync,mkdirSync}=require('fs');mkdirSync('data',{recursive:true});cpSync('src/data/cve-snapshot.json','data/cve-snapshot.json');\"","test:watch":"vitest","build:action":"tsup --config tsup.config.ts","prepublishOnly":"npm run build","update-cve-snapshot":"npx tsx src/scripts/update-cve-snapshot.ts"},"_npmUser":{"name":"GitHub Actions","email":"npm-oidc-no-reply@github.com","trustedPublisher":{"id":"github","oidcConfigId":"oidc:79f2445a-cc57-4124-9090-93eb2a153fa5"}},"overrides":{"lodash":"4.17.21","xml2js":">=0.5.0"},"repository":{"url":"git+https://github.com/Abanoub-Rodolf/mcp-scan.git","type":"git"},"_npmVersion":"11.17.0","description":"Open-source security scanner for Model Context Protocol (MCP) servers. Audits Claude Desktop, VS Code, Cursor, Windsurf, and 12 more AI tools for secrets, prompt injection, supply-chain risks, and 17 security checks.","directories":{},"_nodeVersion":"24.19.0","dependencies":{"ora":"^8.0.1","zod":"^3.23.8","uuid":"^13.0.0","yaml":"^2.8.3","chalk":"^5.3.0","semver":"^7.7.4","blessed":"^0.1.81","commander":"^12.0.0","fast-glob":"^3.3.3","smol-toml":"^1.6.1","cli-table3":"^0.6.4","blessed-contrib":"^4.11.0"},"_hasShrinkwrap":false,"devDependencies":{"tsup":"^8.0.2","execa":"^9.6.1","eslint":"^10.1.0","vitest":"^4.1.1","globals":"^17.4.0","@eslint/js":"^10.0.1","typescript":"^5.4.5","vuln-vects":"^1.1.0","@types/node":"^20.12.7","@types/uuid":"^10.0.0","@actions/core":"^3.0.0","@types/semver":"^7.7.1","@types/blessed":"^0.1.27","typescript-eslint":"^8.57.1","@vitest/coverage-v8":"^4.1.1","@typescript-eslint/parser":"^8.57.1","@typescript-eslint/eslint-plugin":"^8.57.1"},"_npmOperationalInternal":{"tmp":"tmp/mcp-scan_2.0.3_1786766108335_0.6472929270282175","host":"s3://npm-registry-packages-npm-production"}},"2.0.4":{"name":"mcp-scan","version":"2.0.4","keywords":["mcp","security","scanner","audit","model-context-protocol","mcp-scan","mcp-security","mcp-server","claude-desktop","cursor","vscode","windsurf","ai-security","llm-security","prompt-injection","supply-chain-security","secret-detection","typosquatting","data-flow-analysis","sarif","github-action","cli","devtools","security-audit","vulnerability-scanner"],"author":{"name":"Abanoub Rodolf Boctor","email":"rodolf@thynkq.com"},"license":"MIT","_id":"mcp-scan@2.0.4","maintainers":[{"name":"rodolfboctor","email":"rodolf@thynkq.com"}],"homepage":"https://thynkq.com/products/mcp-scan","bugs":{"url":"https://github.com/Abanoub-Rodolf/mcp-scan/issues"},"bin":{"mcp-scan":"dist/index.js"},"dist":{"shasum":"365e60590b6b5d00f4ce1bf5576381d6abe96b05","tarball":"https://registry.npmjs.org/mcp-scan/-/mcp-scan-2.0.4.tgz","fileCount":38,"integrity":"sha512-coYgfYhjZWhA//s+Anai0OJZwiPYpteYuxpn4bhqF52/sJ6LEhMshehJJPklmjPwIZIKkj66oWjR6M8EDfrAaQ==","signatures":[{"sig":"MEUCIQDugJKn0/3r+q7AqyIiKwr5cZDmRSzhCQP9eoil/ulBlwIgEPKjawCBLUSE44YE82d4CgsWiZOwSqoyUQTDbb34e3w=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"attestations":{"url":"https://registry.npmjs.org/-/npm/v1/attestations/mcp-scan@2.0.4","provenance":{"predicateType":"https://slsa.dev/provenance/v1"}},"unpackedSize":1457960},"main":"./dist/lib.js","type":"module","types":"./dist/lib.d.ts","module":"./dist/lib.js","engines":{"node":">=18"},"exports":{".":{"types":"./dist/lib.d.ts","import":"./dist/lib.js","require":"./dist/lib.cjs"}},"funding":{"url":"https://github.com/sponsors/Abanoub-Rodolf","type":"github"},"gitHead":"cd85a2054f6b06c240adfc77171a71ef53e1e1e1","scripts":{"dev":"tsup --watch","lint":"eslint src --ext .ts","test":"vitest run","build":"tsup && node -e \"const{cpSync,mkdirSync}=require('fs');mkdirSync('data',{recursive:true});cpSync('src/data/cve-snapshot.json','data/cve-snapshot.json');\"","test:watch":"vitest","build:action":"tsup --config tsup.config.ts","prepublishOnly":"npm run build","update-cve-snapshot":"npx tsx src/scripts/update-cve-snapshot.ts"},"_npmUser":{"name":"GitHub Actions","email":"npm-oidc-no-reply@github.com","trustedPublisher":{"id":"github","oidcConfigId":"oidc:79f2445a-cc57-4124-9090-93eb2a153fa5"}},"overrides":{"lodash":"4.17.21","xml2js":">=0.5.0"},"repository":{"url":"git+https://github.com/Abanoub-Rodolf/mcp-scan.git","type":"git"},"_npmVersion":"11.17.0","description":"Open-source security scanner for Model Context Protocol (MCP) servers. Audits Claude Desktop, VS Code, Cursor, Windsurf, and 12 more AI tools for secrets, prompt injection, supply-chain risks, and 17 security checks.","directories":{},"_nodeVersion":"24.19.0","dependencies":{"ora":"^8.0.1","zod":"^3.23.8","uuid":"^13.0.0","yaml":"^2.8.3","chalk":"^5.3.0","semver":"^7.7.4","blessed":"^0.1.81","commander":"^12.0.0","fast-glob":"^3.3.3","smol-toml":"^1.6.1","cli-table3":"^0.6.4","blessed-contrib":"^4.11.0"},"_hasShrinkwrap":false,"devDependencies":{"tsup":"^8.0.2","execa":"^9.6.1","eslint":"^10.1.0","vitest":"^4.1.1","globals":"^17.4.0","@eslint/js":"^10.0.1","typescript":"^5.4.5","vuln-vects":"^1.1.0","@types/node":"^20.12.7","@types/uuid":"^10.0.0","@actions/core":"^3.0.0","@types/semver":"^7.7.1","@types/blessed":"^0.1.27","typescript-eslint":"^8.57.1","@vitest/coverage-v8":"^4.1.1","@typescript-eslint/parser":"^8.57.1","@typescript-eslint/eslint-plugin":"^8.57.1"},"_npmOperationalInternal":{"tmp":"tmp/mcp-scan_2.0.4_1786766430971_0.9931378631536847","host":"s3://npm-registry-packages-npm-production"}},"2.0.5":{"name":"mcp-scan","version":"2.0.5","keywords":["mcp","security","scanner","audit","model-context-protocol","mcp-scan","mcp-security","mcp-server","claude-desktop","cursor","vscode","windsurf","ai-security","llm-security","prompt-injection","supply-chain-security","secret-detection","typosquatting","data-flow-analysis","sarif","github-action","cli","devtools","security-audit","vulnerability-scanner"],"author":{"name":"Abanoub Rodolf Boctor","email":"rodolf@thynkq.com"},"license":"MIT","_id":"mcp-scan@2.0.5","maintainers":[{"name":"rodolfboctor","email":"rodolf@thynkq.com"}],"homepage":"https://thynkq.com/products/mcp-scan","bugs":{"url":"https://github.com/Abanoub-Rodolf/mcp-scan/issues"},"bin":{"mcp-scan":"dist/index.js"},"dist":{"shasum":"44153880cdf0be2c546972a84d8776174268b085","tarball":"https://registry.npmjs.org/mcp-scan/-/mcp-scan-2.0.5.tgz","fileCount":39,"integrity":"sha512-l0Hk76QVwwW1wuYT+9DmIt/TN61t3jUhQ8OGDLE6tewayvPTb+ar/G8PwnP4+GKOR6ObThSXBfcHB9fjoI6nzQ==","signatures":[{"sig":"MEYCIQDjHfK7y8NcNNA5bJ5k6bAOhYPRJYq9yeErFH9mlRZsWwIhALgxbQnsKzc5v7HqCystFWL8KZPabQvzv2NbIqxazp5i","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"attestations":{"url":"https://registry.npmjs.org/-/npm/v1/attestations/mcp-scan@2.0.5","provenance":{"predicateType":"https://slsa.dev/provenance/v1"}},"unpackedSize":1459526},"main":"./dist/lib.js","type":"module","types":"./dist/lib.d.ts","module":"./dist/lib.js","engines":{"node":">=18"},"exports":{".":{"types":"./dist/lib.d.ts","import":"./dist/lib.js","require":"./dist/lib.cjs"}},"funding":{"url":"https://github.com/sponsors/Abanoub-Rodolf","type":"github"},"gitHead":"3d278e9df419ceecda1c36e5e2471d80f99759e2","scripts":{"dev":"tsup --watch","lint":"eslint src --ext .ts","test":"vitest run","build":"tsup && node -e \"const{cpSync,mkdirSync}=require('fs');mkdirSync('data',{recursive:true});cpSync('src/data/cve-snapshot.json','data/cve-snapshot.json');\"","test:watch":"vitest","build:action":"tsup --config tsup.config.ts","prepublishOnly":"npm run build","update-cve-snapshot":"npx tsx src/scripts/update-cve-snapshot.ts"},"_npmUser":{"name":"GitHub Actions","email":"npm-oidc-no-reply@github.com","trustedPublisher":{"id":"github","oidcConfigId":"oidc:79f2445a-cc57-4124-9090-93eb2a153fa5"}},"overrides":{"lodash":"4.17.21","xml2js":">=0.5.0"},"repository":{"url":"git+https://github.com/Abanoub-Rodolf/mcp-scan.git","type":"git"},"_npmVersion":"11.17.0","description":"Open-source security scanner for Model Context Protocol (MCP) servers. Audits Claude Desktop, VS Code, Cursor, Windsurf, and 12 more AI tools for secrets, prompt injection, supply-chain risks, and 17 security checks.","directories":{},"_nodeVersion":"24.19.0","dependencies":{"ora":"^8.0.1","zod":"^3.23.8","uuid":"^13.0.0","yaml":"^2.8.3","chalk":"^5.3.0","semver":"^7.7.4","blessed":"^0.1.81","commander":"^12.0.0","fast-glob":"^3.3.3","smol-toml":"^1.6.1","cli-table3":"^0.6.4","blessed-contrib":"^4.11.0"},"_hasShrinkwrap":false,"devDependencies":{"tsup":"^8.0.2","execa":"^9.6.1","eslint":"^10.1.0","vitest":"^4.1.1","globals":"^17.4.0","@eslint/js":"^10.0.1","typescript":"^5.4.5","vuln-vects":"^1.1.0","@types/node":"^20.12.7","@types/uuid":"^10.0.0","@actions/core":"^3.0.0","@types/semver":"^7.7.1","@types/blessed":"^0.1.27","typescript-eslint":"^8.57.1","@vitest/coverage-v8":"^4.1.1","@typescript-eslint/parser":"^8.57.1","@typescript-eslint/eslint-plugin":"^8.57.1"},"_npmOperationalInternal":{"tmp":"tmp/mcp-scan_2.0.5_1787450080581_0.8003272304384064","host":"s3://npm-registry-packages-npm-production"}},"2.0.6":{"name":"mcp-scan","version":"2.0.6","keywords":["mcp","security","scanner","audit","model-context-protocol","mcp-scan","mcp-security","mcp-server","claude-desktop","cursor","vscode","windsurf","ai-security","llm-security","prompt-injection","supply-chain-security","secret-detection","typosquatting","data-flow-analysis","sarif","github-action","cli","devtools","security-audit","vulnerability-scanner"],"author":{"name":"Abanoub Rodolf Boctor","email":"rodolf@thynkq.com"},"license":"MIT","_id":"mcp-scan@2.0.6","maintainers":[{"name":"rodolfboctor","email":"rodolf@thynkq.com"}],"homepage":"https://thynkq.com/products/mcp-scan","bugs":{"url":"https://github.com/Abanoub-Rodolf/mcp-scan/issues"},"bin":{"mcp-scan":"dist/index.js"},"dist":{"shasum":"32d2c445bdb9985459b156c77780074570ffa57a","tarball":"https://registry.npmjs.org/mcp-scan/-/mcp-scan-2.0.6.tgz","fileCount":39,"integrity":"sha512-wDwhUaIcFbeyK0DWc8iQ50szJhiLsqlrE+HB3GXCrLWLDaxSIa4SWeB5uOIqYlIb/42iuSGMOcAoTe+AqaHOaQ==","signatures":[{"sig":"MEYCIQD8dfoEAO8L/LnPl6KfPcWmM7Nekr9idkJevWlyknZCpwIhAP+beOvr1DcYqqXQvZWbufEAp7QrwuhLxj3Pkz6QF/NO","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"attestations":{"url":"https://registry.npmjs.org/-/npm/v1/attestations/mcp-scan@2.0.6","provenance":{"predicateType":"https://slsa.dev/provenance/v1"}},"unpackedSize":1462862},"main":"./dist/lib.js","type":"module","types":"./dist/lib.d.ts","module":"./dist/lib.js","engines":{"node":">=18"},"exports":{".":{"types":"./dist/lib.d.ts","import":"./dist/lib.js","require":"./dist/lib.cjs"}},"funding":{"url":"https://github.com/sponsors/Abanoub-Rodolf","type":"github"},"gitHead":"8b0b47b7a51b0c1024e6b9d734fbcd5d6424b53c","scripts":{"dev":"tsup --watch","lint":"eslint src --ext .ts","test":"vitest run","build":"tsup && node -e \"const{cpSync,mkdirSync}=require('fs');mkdirSync('data',{recursive:true});cpSync('src/data/cve-snapshot.json','data/cve-snapshot.json');\"","test:watch":"vitest","build:action":"tsup --config tsup.config.ts","prepublishOnly":"npm run build","update-cve-snapshot":"npx tsx src/scripts/update-cve-snapshot.ts"},"_npmUser":{"name":"GitHub Actions","email":"npm-oidc-no-reply@github.com","trustedPublisher":{"id":"github","oidcConfigId":"oidc:79f2445a-cc57-4124-9090-93eb2a153fa5"}},"overrides":{"lodash":"4.17.21","xml2js":">=0.5.0"},"repository":{"url":"git+https://github.com/Abanoub-Rodolf/mcp-scan.git","type":"git"},"_npmVersion":"11.17.0","description":"Open-source security scanner for Model Context Protocol (MCP) servers. Audits Claude Desktop, VS Code, Cursor, Windsurf, and 12 more AI tools for secrets, prompt injection, supply-chain risks, and 17 security checks.","directories":{},"_nodeVersion":"24.19.0","dependencies":{"ora":"^8.0.1","zod":"^3.23.8","uuid":"^13.0.0","yaml":"^2.8.3","chalk":"^5.3.0","semver":"^7.7.4","blessed":"^0.1.81","commander":"^12.0.0","fast-glob":"^3.3.3","smol-toml":"^1.6.1","cli-table3":"^0.6.4","blessed-contrib":"^4.11.0"},"_hasShrinkwrap":false,"devDependencies":{"tsup":"^8.5.1","execa":"^9.6.1","eslint":"^10.1.0","vitest":"^4.1.11","globals":"^17.4.0","@eslint/js":"^10.0.1","typescript":"^5.4.5","vuln-vects":"^1.1.0","@types/node":"^20.12.7","@types/uuid":"^10.0.0","@actions/core":"^3.0.0","@types/semver":"^7.7.1","@types/blessed":"^0.1.27","typescript-eslint":"^8.57.1","@vitest/coverage-v8":"^4.1.1","@typescript-eslint/parser":"^8.57.1","@typescript-eslint/eslint-plugin":"^8.57.1"},"_npmOperationalInternal":{"tmp":"tmp/mcp-scan_2.0.6_1787451439999_0.5595225711267569","host":"s3://npm-registry-packages-npm-production"}},"2.0.7":{"name":"mcp-scan","version":"2.0.7","keywords":["mcp","security","scanner","audit","model-context-protocol","mcp-scan","mcp-security","mcp-server","claude-desktop","cursor","vscode","windsurf","ai-security","llm-security","prompt-injection","supply-chain-security","secret-detection","typosquatting","data-flow-analysis","sarif","github-action","cli","devtools","security-audit","vulnerability-scanner"],"author":{"name":"Abanoub Rodolf Boctor","email":"rodolf@thynkq.com"},"license":"MIT","_id":"mcp-scan@2.0.7","maintainers":[{"name":"rodolfboctor","email":"rodolf@thynkq.com"}],"homepage":"https://thynkq.com/products/mcp-scan","bugs":{"url":"https://github.com/Abanoub-Rodolf/mcp-scan/issues"},"bin":{"mcp-scan":"dist/index.js"},"dist":{"shasum":"9ec386407f1a53385e637547bb340f85dcdaedb4","tarball":"https://registry.npmjs.org/mcp-scan/-/mcp-scan-2.0.7.tgz","fileCount":40,"integrity":"sha512-Woyc6Z/mGQm05A5YRYDtE/xS7vkHO+kIrHJRhEALQOjbU0U70u3UJDuyCakobFGV4NVtZbmd0+4M/mv+lJajQA==","signatures":[{"sig":"MEUCIQCfva31ueE7CyYsvKrneQrLF24GWoFuKDzb2g0zvwQV3gIgbAHQr0FBdT1+jvwbzQIALF8g6WLRynlirdF6RfM3iq8=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"attestations":{"url":"https://registry.npmjs.org/-/npm/v1/attestations/mcp-scan@2.0.7","provenance":{"predicateType":"https://slsa.dev/provenance/v1"}},"unpackedSize":1463341},"main":"./dist/lib.js","type":"module","types":"./dist/lib.d.ts","module":"./dist/lib.js","engines":{"node":">=18"},"exports":{".":{"types":"./dist/lib.d.ts","import":"./dist/lib.js","require":"./dist/lib.cjs"}},"funding":{"url":"https://github.com/sponsors/Abanoub-Rodolf","type":"github"},"gitHead":"2ed537c699f41031173e310568fe5186915bf91c","scripts":{"dev":"tsup --watch","lint":"eslint src --ext .ts","test":"vitest run","build":"tsup && node -e \"const{cpSync,mkdirSync}=require('fs');mkdirSync('data',{recursive:true});cpSync('src/data/cve-snapshot.json','data/cve-snapshot.json');\"","test:watch":"vitest","build:action":"tsup --config tsup.config.ts","prepublishOnly":"npm run build","update-cve-snapshot":"npx tsx src/scripts/update-cve-snapshot.ts"},"_npmUser":{"name":"GitHub Actions","email":"npm-oidc-no-reply@github.com","trustedPublisher":{"id":"github","oidcConfigId":"oidc:79f2445a-cc57-4124-9090-93eb2a153fa5"}},"overrides":{"lodash":"4.17.21","xml2js":">=0.5.0"},"repository":{"url":"git+https://github.com/Abanoub-Rodolf/mcp-scan.git","type":"git"},"_npmVersion":"11.17.0","description":"Open-source security scanner for Model Context Protocol (MCP) servers. Audits Claude Desktop, VS Code, Cursor, Windsurf, and 12 more AI tools for secrets, prompt injection, supply-chain risks, and 17 security checks.","directories":{},"_nodeVersion":"24.19.0","dependencies":{"ora":"^8.0.1","zod":"^3.23.8","uuid":"^13.0.0","yaml":"^2.8.3","chalk":"^5.3.0","semver":"^7.7.4","blessed":"^0.1.81","commander":"^12.0.0","fast-glob":"^3.3.3","smol-toml":"^1.6.1","cli-table3":"^0.6.4","blessed-contrib":"^4.11.0"},"_hasShrinkwrap":false,"devDependencies":{"tsup":"^8.5.1","execa":"^9.6.1","eslint":"^10.1.0","vitest":"^4.1.11","globals":"^17.4.0","@eslint/js":"^10.0.1","typescript":"^5.4.5","vuln-vects":"^1.1.0","@types/node":"^20.12.7","@types/uuid":"^10.0.0","@actions/core":"^3.0.0","@types/semver":"^7.7.1","@types/blessed":"^0.1.27","typescript-eslint":"^8.57.1","@vitest/coverage-v8":"^4.1.1","@typescript-eslint/parser":"^8.57.1","@typescript-eslint/eslint-plugin":"^8.57.1"},"_npmOperationalInternal":{"tmp":"tmp/mcp-scan_2.0.7_1788029759778_0.26679272243153274","host":"s3://npm-registry-packages-npm-production"}},"2.0.8":{"name":"mcp-scan","version":"2.0.8","keywords":["mcp","security","scanner","audit","model-context-protocol","mcp-scan","mcp-security","mcp-server","claude-desktop","cursor","vscode","windsurf","ai-security","llm-security","prompt-injection","supply-chain-security","secret-detection","typosquatting","data-flow-analysis","sarif","github-action","cli","devtools","security-audit","vulnerability-scanner"],"author":{"name":"Abanoub Rodolf Boctor","email":"rodolf@thynkq.com"},"license":"MIT","_id":"mcp-scan@2.0.8","maintainers":[{"name":"rodolfboctor","email":"rodolf@thynkq.com"}],"homepage":"https://thynkq.com/products/mcp-scan","bugs":{"url":"https://github.com/Abanoub-Rodolf/mcp-scan/issues"},"bin":{"mcp-scan":"dist/index.js"},"dist":{"shasum":"20ce29a3c35ca7bf9512e3e26b95a41d44e7973c","tarball":"https://registry.npmjs.org/mcp-scan/-/mcp-scan-2.0.8.tgz","fileCount":40,"integrity":"sha512-XKQTotaDj6zRfebuhQhTwOxicBJ8Q6dXJHHweu71Vs6IZojIFU1WnNli2cyjHerqCLHVrDIejxGGx3RAK2RW9w==","signatures":[{"sig":"MEUCIECN4nmBx8VMB0CYnDH3zjnURXaIoU4Mi5dRob/AFsHJAiEA0Pod0yPVa4ezSATktqc/BLYqaQcdcA0eYRFlRwd16fI=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":1463703},"main":"./dist/lib.js","type":"module","types":"./dist/lib.d.ts","module":"./dist/lib.js","engines":{"node":">=18"},"exports":{".":{"types":"./dist/lib.d.ts","import":"./dist/lib.js","require":"./dist/lib.cjs"}},"funding":{"url":"https://github.com/sponsors/Abanoub-Rodolf","type":"github"},"gitHead":"205e4e120bfe3dee75375e112deb3038f301dabb","scripts":{"dev":"tsup --watch","lint":"eslint src --ext .ts","test":"vitest run","build":"tsup && node -e \"const{cpSync,mkdirSync}=require('fs');mkdirSync('data',{recursive:true});cpSync('src/data/cve-snapshot.json','data/cve-snapshot.json');\"","test:watch":"vitest","build:action":"tsup --config tsup.config.ts","prepublishOnly":"npm run build","update-cve-snapshot":"npx tsx src/scripts/update-cve-snapshot.ts"},"_npmUser":{"name":"rodolfboctor","email":"rodolf@thynkq.com"},"overrides":{"lodash":"4.17.21","xml2js":">=0.5.0"},"repository":{"url":"git+https://github.com/Abanoub-Rodolf/mcp-scan.git","type":"git"},"_npmVersion":"10.9.8","description":"Open-source security scanner for Model Context Protocol (MCP) servers. Audits Claude Desktop, VS Code, Cursor, Windsurf, and 12 more AI tools for secrets, prompt injection, supply-chain risks, and 17 security checks.","directories":{},"_nodeVersion":"22.23.1","dependencies":{"ora":"^8.0.1","zod":"^3.23.8","uuid":"^13.0.0","yaml":"^2.8.3","chalk":"^5.3.0","semver":"^7.7.4","blessed":"^0.1.81","commander":"^12.0.0","fast-glob":"^3.3.3","smol-toml":"^1.6.1","cli-table3":"^0.6.4","blessed-contrib":"^4.11.0"},"_hasShrinkwrap":false,"devDependencies":{"tsup":"^8.5.1","execa":"^9.6.1","eslint":"^10.1.0","vitest":"^4.1.11","globals":"^17.4.0","@eslint/js":"^10.0.1","typescript":"^5.4.5","vuln-vects":"^1.1.0","@types/node":"^20.12.7","@types/uuid":"^10.0.0","@actions/core":"^3.0.0","@types/semver":"^7.7.1","@types/blessed":"^0.1.27","typescript-eslint":"^8.57.1","@vitest/coverage-v8":"^4.1.1","@typescript-eslint/parser":"^8.57.1","@typescript-eslint/eslint-plugin":"^8.57.1"},"_npmOperationalInternal":{"tmp":"tmp/mcp-scan_2.0.8_1788107697087_0.5618279355984848","host":"s3://npm-registry-packages-npm-production"}},"2.0.9":{"name":"mcp-scan","version":"2.0.9","keywords":["mcp","security","scanner","audit","model-context-protocol","mcp-scan","mcp-security","mcp-server","claude-desktop","cursor","vscode","windsurf","ai-security","llm-security","prompt-injection","supply-chain-security","secret-detection","typosquatting","data-flow-analysis","sarif","github-action","cli","devtools","security-audit","vulnerability-scanner"],"author":{"name":"Abanoub Rodolf Boctor","email":"rodolf@thynkq.com"},"license":"MIT","_id":"mcp-scan@2.0.9","maintainers":[{"name":"rodolfboctor","email":"rodolf@thynkq.com"}],"homepage":"https://thynkq.com/products/mcp-scan","bugs":{"url":"https://github.com/Abanoub-Rodolf/mcp-scan/issues"},"bin":{"mcp-scan":"dist/index.js"},"dist":{"shasum":"70a003f14d345cb90669f9aebade753f0a520ade","tarball":"https://registry.npmjs.org/mcp-scan/-/mcp-scan-2.0.9.tgz","fileCount":40,"integrity":"sha512-bHQ67/+KVH2Ts1v8t9f9DtrAqy3C53YTNK2ZBhKojCoNUekh40dgn98lOuFZiFYmzRa9UNVddTk/8zut8x2hvQ==","signatures":[{"sig":"MEUCIQDi6GyqAxfkZeCf4HVuvslvqCEJVS+0TiAZ0ODJzvnWbgIgV5WaMc6U7UkJqUZQbTrl+JngOSmNx4nPn1Z8mnvR5Yo=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"attestations":{"url":"https://registry.npmjs.org/-/npm/v1/attestations/mcp-scan@2.0.9","provenance":{"predicateType":"https://slsa.dev/provenance/v1"}},"unpackedSize":1484238},"main":"./dist/lib.js","type":"module","types":"./dist/lib.d.ts","module":"./dist/lib.js","engines":{"node":">=18"},"exports":{".":{"types":"./dist/lib.d.ts","import":"./dist/lib.js","require":"./dist/lib.cjs"}},"funding":{"url":"https://github.com/sponsors/Abanoub-Rodolf","type":"github"},"gitHead":"57737316682515bb7ee8fab27d468e0cb392954e","scripts":{"dev":"tsup --watch","lint":"eslint src --ext .ts","test":"vitest run","build":"tsup && node -e \"const{cpSync,mkdirSync}=require('fs');mkdirSync('data',{recursive:true});cpSync('src/data/cve-snapshot.json','data/cve-snapshot.json');\"","test:watch":"vitest","build:action":"tsup --config tsup.config.ts","prepublishOnly":"npm run build","update-cve-snapshot":"npx tsx src/scripts/update-cve-snapshot.ts"},"_npmUser":{"name":"GitHub Actions","email":"npm-oidc-no-reply@github.com","trustedPublisher":{"id":"github","oidcConfigId":"oidc:79f2445a-cc57-4124-9090-93eb2a153fa5"}},"overrides":{"lodash":"4.17.21","xml2js":">=0.5.0"},"repository":{"url":"git+https://github.com/Abanoub-Rodolf/mcp-scan.git","type":"git"},"_npmVersion":"11.17.0","description":"Open-source security scanner for Model Context Protocol (MCP) servers. Audits Claude Desktop, VS Code, Cursor, Windsurf, and 12 more AI tools for secrets, prompt injection, supply-chain risks, and 17 security checks.","directories":{},"_nodeVersion":"24.19.0","dependencies":{"ora":"^8.0.1","zod":"^3.23.8","uuid":"^13.0.0","yaml":"^2.8.3","chalk":"^5.3.0","semver":"^7.7.4","blessed":"^0.1.81","commander":"^12.0.0","fast-glob":"^3.3.3","smol-toml":"^1.6.1","cli-table3":"^0.6.4","blessed-contrib":"^4.11.0"},"_hasShrinkwrap":false,"devDependencies":{"tsup":"^8.5.1","execa":"^9.6.1","eslint":"^10.1.0","vitest":"^4.1.11","globals":"^17.4.0","@eslint/js":"^10.0.1","typescript":"^5.4.5","vuln-vects":"^1.1.0","@types/node":"^20.12.7","@types/uuid":"^10.0.0","@actions/core":"^3.0.0","@types/semver":"^7.7.1","@types/blessed":"^0.1.27","typescript-eslint":"^8.57.1","@vitest/coverage-v8":"^4.1.1","@typescript-eslint/parser":"^8.57.1","@typescript-eslint/eslint-plugin":"^8.57.1"},"_npmOperationalInternal":{"tmp":"tmp/mcp-scan_2.0.9_1788278268311_0.5927526807026302","host":"s3://npm-registry-packages-npm-production"}},"2.0.10":{"name":"mcp-scan","version":"2.0.10","keywords":["mcp","security","scanner","audit","model-context-protocol","mcp-scan","mcp-security","mcp-server","claude-desktop","cursor","vscode","windsurf","ai-security","llm-security","prompt-injection","supply-chain-security","secret-detection","typosquatting","data-flow-analysis","sarif","github-action","cli","devtools","security-audit","vulnerability-scanner"],"author":{"name":"Abanoub Rodolf Boctor","email":"rodolf@thynkq.com"},"license":"MIT","_id":"mcp-scan@2.0.10","maintainers":[{"name":"rodolfboctor","email":"rodolf@thynkq.com"}],"homepage":"https://thynkq.com/products/mcp-scan","bugs":{"url":"https://github.com/Abanoub-Rodolf/mcp-scan/issues"},"bin":{"mcp-scan":"dist/index.js"},"dist":{"shasum":"d87dd97a0e271db8ca24be49eec8d33541213194","tarball":"https://registry.npmjs.org/mcp-scan/-/mcp-scan-2.0.10.tgz","fileCount":40,"integrity":"sha512-vkPEYYeJTGZmAKRik5ebgajFe4/8fkAl04tBZTx1lHuYqpiyIYmG0dIo+Pe4b5qx360pNxzTTO95RlS7DhpPCg==","signatures":[{"sig":"MEYCIQCq0fMz0Z5/2vFohLuk0OBUSHxrmypy1REt8DS/nSJE/AIhANOHDk+BHDl9PljIMeNeHqOZyGKQZ2Ib34Ib5ufldrSl","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"attestations":{"url":"https://registry.npmjs.org/-/npm/v1/attestations/mcp-scan@2.0.10","provenance":{"predicateType":"https://slsa.dev/provenance/v1"}},"unpackedSize":1486173},"main":"./dist/lib.js","type":"module","types":"./dist/lib.d.ts","module":"./dist/lib.js","engines":{"node":">=18"},"exports":{".":{"types":"./dist/lib.d.ts","import":"./dist/lib.js","require":"./dist/lib.cjs"}},"funding":{"url":"https://github.com/sponsors/Abanoub-Rodolf","type":"github"},"gitHead":"8f6d5568000e95eb14cf919e616750a551caa51a","scripts":{"dev":"tsup --watch","lint":"eslint src --ext .ts","test":"vitest run","build":"tsup && node -e \"const{cpSync,mkdirSync}=require('fs');mkdirSync('data',{recursive:true});cpSync('src/data/cve-snapshot.json','data/cve-snapshot.json');\"","test:watch":"vitest","build:action":"tsup --config tsup.config.ts","prepublishOnly":"npm run build","update-cve-snapshot":"npx tsx src/scripts/update-cve-snapshot.ts"},"_npmUser":{"name":"GitHub Actions","email":"npm-oidc-no-reply@github.com","trustedPublisher":{"id":"github","oidcConfigId":"oidc:79f2445a-cc57-4124-9090-93eb2a153fa5"}},"overrides":{"lodash":"4.17.21","xml2js":">=0.5.0"},"repository":{"url":"git+https://github.com/Abanoub-Rodolf/mcp-scan.git","type":"git"},"_npmVersion":"11.17.0","description":"Open-source security scanner for Model Context Protocol (MCP) servers. Audits Claude Desktop, VS Code, Cursor, Windsurf, and 12 more AI tools for secrets, prompt injection, supply-chain risks, and 17 security checks.","directories":{},"_nodeVersion":"24.19.0","dependencies":{"ora":"^8.0.1","zod":"^3.23.8","uuid":"^13.0.0","yaml":"^2.8.3","chalk":"^5.3.0","semver":"^7.7.4","blessed":"^0.1.81","commander":"^12.0.0","fast-glob":"^3.3.3","smol-toml":"^1.6.1","cli-table3":"^0.6.4","blessed-contrib":"^4.11.0"},"_hasShrinkwrap":false,"devDependencies":{"tsup":"^8.5.1","execa":"^9.6.1","eslint":"^10.1.0","vitest":"^4.1.11","globals":"^17.4.0","@eslint/js":"^10.0.1","typescript":"^5.4.5","vuln-vects":"^1.1.0","@types/node":"^20.12.7","@types/uuid":"^10.0.0","@actions/core":"^3.0.0","@types/semver":"^7.7.1","@types/blessed":"^0.1.27","typescript-eslint":"^8.57.1","@vitest/coverage-v8":"^4.1.1","@typescript-eslint/parser":"^8.57.1","@typescript-eslint/eslint-plugin":"^8.57.1"},"_npmOperationalInternal":{"tmp":"tmp/mcp-scan_2.0.10_1788314716738_0.6090120216724919","host":"s3://npm-registry-packages-npm-production"}},"2.0.12":{"name":"mcp-scan","version":"2.0.12","keywords":["mcp","security","scanner","audit","model-context-protocol","mcp-scan","mcp-security","mcp-server","claude-desktop","cursor","vscode","windsurf","ai-security","llm-security","prompt-injection","supply-chain-security","secret-detection","typosquatting","data-flow-analysis","sarif","github-action","cli","devtools","security-audit","vulnerability-scanner"],"author":{"name":"Abanoub Rodolf Boctor","email":"rodolf@thynkq.com"},"license":"MIT","_id":"mcp-scan@2.0.12","maintainers":[{"name":"rodolfboctor","email":"rodolf@thynkq.com"}],"homepage":"https://gitlab.com/abanoub.rodolf/mcp-scan","bugs":{"url":"https://gitlab.com/abanoub.rodolf/mcp-scan/-/issues"},"bin":{"mcp-scan":"dist/index.js"},"dist":{"shasum":"9195a2bcd874bae7e57db2964042bbe390665ab5","tarball":"https://registry.npmjs.org/mcp-scan/-/mcp-scan-2.0.12.tgz","fileCount":42,"integrity":"sha512-eHD5SYIzfmnYV6mMsJCJk61OShhPdPhugphl0gurlQEJ0cE34Aw5QV2gfpssr+e27WrpI15R61sWBSaHs9I6iQ==","signatures":[{"sig":"MEQCIHEhI34eEIWakaGTJmv4COHhmH6AkeGQCUUT95C5AlVZAiBv8jzZ3fFGy09NhzgXEt8pdhPsAgjVLM8Xb2Kdyasu+w==","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"attestations":{"url":"https://registry.npmjs.org/-/npm/v1/attestations/mcp-scan@2.0.12","provenance":{"predicateType":"https://slsa.dev/provenance/v1"}},"unpackedSize":1498854},"main":"./dist/lib.js","type":"module","types":"./dist/lib.d.ts","module":"./dist/lib.js","engines":{"node":">=18"},"exports":{".":{"types":"./dist/lib.d.ts","import":"./dist/lib.js","require":"./dist/lib.cjs"}},"funding":{"url":"https://github.com/sponsors/Abanoub-Rodolf","type":"github"},"gitHead":"25c47c68c72d9671bacf43159e4428cd50fcb214","scripts":{"dev":"tsup --watch","lint":"eslint src --ext .ts","test":"vitest run","build":"tsup && node -e \"const{cpSync,mkdirSync}=require('fs');mkdirSync('data',{recursive:true});cpSync('src/data/cve-snapshot.json','data/cve-snapshot.json');\"","test:watch":"vitest","build:action":"tsup --config tsup.config.ts","prepublishOnly":"npm run build","update-cve-snapshot":"npx tsx src/scripts/update-cve-snapshot.ts"},"_npmUser":{"name":"GitHub Actions","email":"npm-oidc-no-reply@github.com","trustedPublisher":{"id":"github","oidcConfigId":"oidc:79f2445a-cc57-4124-9090-93eb2a153fa5"}},"overrides":{"lodash":"4.17.21","xml2js":">=0.5.0"},"repository":{"url":"git+https://github.com/Abanoub-Rodolf/mcp-scan.git","type":"git"},"_npmVersion":"11.19.0","description":"Open-source security scanner for Model Context Protocol (MCP) servers. Audits Claude Desktop, VS Code, Cursor, Windsurf, and 12 more AI tools for secrets, prompt injection, supply-chain risks, and 17 security checks.","directories":{},"_nodeVersion":"24.20.0","dependencies":{"ora":"^8.0.1","zod":"^3.23.8","uuid":"^13.0.0","yaml":"^2.8.3","chalk":"^5.3.0","semver":"^7.7.4","commander":"^12.0.0","fast-glob":"^3.3.3","smol-toml":"^1.6.1","cli-table3":"^0.6.4"},"_hasShrinkwrap":false,"devDependencies":{"tsup":"^8.5.1","execa":"^9.6.1","eslint":"^10.1.0","vitest":"^4.1.11","globals":"^17.4.0","@eslint/js":"^10.0.1","typescript":"^5.4.5","vuln-vects":"^1.1.0","@types/node":"^20.12.7","@types/uuid":"^10.0.0","@actions/core":"^3.0.0","@types/semver":"^7.7.1","@types/blessed":"^0.1.27","typescript-eslint":"^8.57.1","@vitest/coverage-v8":"^4.1.1","@typescript-eslint/parser":"^8.57.1","@typescript-eslint/eslint-plugin":"^8.57.1"},"optionalDependencies":{"blessed":"^0.1.81","blessed-contrib":"^4.11.0"},"_npmOperationalInternal":{"tmp":"tmp/mcp-scan_2.0.12_1788646985492_0.13970702900062815","host":"s3://npm-registry-packages-npm-production"}},"2.0.13":{"name":"mcp-scan","version":"2.0.13","description":"Open-source security scanner for Model Context Protocol (MCP) servers. Audits Claude Desktop, VS Code, Cursor, Windsurf, and 12 more AI tools for secrets, prompt injection, supply-chain risks, and 17 security checks.","type":"module","main":"./dist/lib.js","module":"./dist/lib.js","types":"./dist/lib.d.ts","exports":{".":{"types":"./dist/lib.d.ts","import":"./dist/lib.js","require":"./dist/lib.cjs"}},"bin":{"mcp-scan":"dist/index.js"},"engines":{"node":">=18"},"overrides":{"xml2js":">=0.5.0","lodash":"4.17.21"},"scripts":{"build":"tsup && node -e \"const{cpSync,mkdirSync}=require('fs');mkdirSync('data',{recursive:true});cpSync('src/data/cve-snapshot.json','data/cve-snapshot.json');\"","build:action":"tsup --config tsup.config.ts","dev":"tsup --watch","test":"vitest run","test:watch":"vitest","lint":"eslint src --ext .ts","update-cve-snapshot":"npx tsx src/scripts/update-cve-snapshot.ts","prepublishOnly":"npm run build"},"repository":{"type":"git","url":"git+https://github.com/Abanoub-Rodolf/mcp-scan.git"},"keywords":["mcp","security","scanner","audit","model-context-protocol","mcp-scan","mcp-security","mcp-server","claude-desktop","cursor","vscode","windsurf","ai-security","llm-security","prompt-injection","supply-chain-security","secret-detection","typosquatting","data-flow-analysis","sarif","github-action","cli","devtools","security-audit","vulnerability-scanner"],"author":{"name":"Abanoub Rodolf Boctor","email":"rodolf@thynkq.com"},"license":"MIT","funding":{"type":"github","url":"https://github.com/sponsors/Abanoub-Rodolf"},"bugs":{"url":"https://gitlab.com/abanoub.rodolf/mcp-scan/-/issues"},"homepage":"https://gitlab.com/abanoub.rodolf/mcp-scan","dependencies":{"chalk":"^5.3.0","cli-table3":"^0.6.4","commander":"^12.0.0","fast-glob":"^3.3.3","ora":"^8.0.1","semver":"^7.7.4","smol-toml":"^1.6.1","uuid":"^13.0.0","yaml":"^2.8.3","zod":"^3.23.8"},"optionalDependencies":{"blessed":"^0.1.81","blessed-contrib":"^4.11.0"},"devDependencies":{"@actions/core":"^3.0.0","@eslint/js":"^10.0.1","@types/blessed":"^0.1.27","@types/node":"^20.12.7","@types/semver":"^7.7.1","@types/uuid":"^10.0.0","@typescript-eslint/eslint-plugin":"^8.57.1","@typescript-eslint/parser":"^8.57.1","@vitest/coverage-v8":"^4.1.1","eslint":"^10.1.0","execa":"^9.6.1","globals":"^17.4.0","tsup":"^8.5.1","typescript":"^5.4.5","typescript-eslint":"^8.57.1","vitest":"^4.1.11","vuln-vects":"^1.1.0"},"gitHead":"86d8ffe9a9fc1916e3215894d30af1485d9bacbb","_id":"mcp-scan@2.0.13","_nodeVersion":"24.20.0","_npmVersion":"11.19.0","dist":{"integrity":"sha512-hCLg2J9NyXVR9R3fj7h+W1wdc/VQSzhF9xz+HBNG3cTmV8spGkL4TUrjoXlPe+q6rj4SzHlSdOFpRG7ha0Aq+Q==","shasum":"aebef0dbd17ad7dea6dd0a6dc9334a3eeffd75da","tarball":"https://registry.npmjs.org/mcp-scan/-/mcp-scan-2.0.13.tgz","fileCount":42,"unpackedSize":1523609,"attestations":{"url":"https://registry.npmjs.org/-/npm/v1/attestations/mcp-scan@2.0.13","provenance":{"predicateType":"https://slsa.dev/provenance/v1"}},"signatures":[{"keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U","sig":"MEQCIAELmHF4yskt36R7PNgEpaSsfJGPO6OI0t6mbTqerD7TAiB5y0/nTRKmo2TMOpP+zIJp1lVxsLwcGZ/GnS/Je9AAUQ=="}]},"_npmUser":{"name":"GitHub Actions","email":"npm-oidc-no-reply@github.com","trustedPublisher":{"id":"github","oidcConfigId":"oidc:79f2445a-cc57-4124-9090-93eb2a153fa5"}},"directories":{},"maintainers":[{"name":"rodolfboctor","email":"rodolf@thynkq.com"}],"_npmOperationalInternal":{"host":"s3://npm-registry-packages-npm-production","tmp":"tmp/mcp-scan_2.0.13_1788914296737_0.7829427945637535"},"_hasShrinkwrap":false}},"time":{"created":"2026-03-23T09:26:17.042Z","modified":"2026-09-09T00:38:17.210Z","0.1.5":"2025-04-24T08:47:37.270Z","0.1.6":"2025-04-24T10:08:04.202Z","0.1.7":"2025-05-06T15:34:11.816Z","0.1.8":"2025-05-06T18:07:45.908Z","0.1.9":"2025-05-06T19:16:33.438Z","0.1.12":"2025-05-08T12:11:00.799Z","0.1.13":"2025-05-09T14:00:01.208Z","0.1.14":"2025-05-12T14:24:56.675Z","0.1.15":"2025-05-13T12:39:22.913Z","0.1.16":"2025-05-13T15:00:20.823Z","0.1.17":"2025-05-20T15:31:55.068Z","0.2.1":"2025-05-22T09:53:26.797Z","1.0.0":"2026-03-23T09:26:17.266Z","1.0.1":"2026-03-23T16:57:21.003Z","1.0.2":"2026-03-23T20:29:53.177Z","1.3.0":"2026-03-24T06:44:21.214Z","1.5.0":"2026-03-24T07:13:03.927Z","1.7.1":"2026-03-24T21:57:04.410Z","1.7.2":"2026-03-24T22:07:00.590Z","1.7.3":"2026-03-24T22:21:45.393Z","1.7.5":"2026-03-25T23:57:51.710Z","1.7.6":"2026-03-26T02:08:09.679Z","2.0.0":"2026-03-28T04:50:35.420Z","2.0.1":"2026-03-28T20:48:01.450Z","2.0.2":"2026-04-27T19:49:02.716Z","2.0.3":"2026-08-15T03:55:08.518Z","2.0.4":"2026-08-15T04:00:31.137Z","2.0.5":"2026-08-23T01:54:40.744Z","2.0.6":"2026-08-23T02:17:20.159Z","2.0.7":"2026-08-29T18:55:59.923Z","2.0.8":"2026-08-30T16:34:57.288Z","2.0.9":"2026-09-01T15:57:48.450Z","2.0.10":"2026-09-02T02:05:16.974Z","2.0.12":"2026-09-05T22:23:05.625Z","2.0.13":"2026-09-09T00:38:16.899Z"},"bugs":{"url":"https://gitlab.com/abanoub.rodolf/mcp-scan/-/issues"},"author":{"name":"Abanoub Rodolf Boctor","email":"rodolf@thynkq.com"},"license":"MIT","homepage":"https://gitlab.com/abanoub.rodolf/mcp-scan","keywords":["mcp","security","scanner","audit","model-context-protocol","mcp-scan","mcp-security","mcp-server","claude-desktop","cursor","vscode","windsurf","ai-security","llm-security","prompt-injection","supply-chain-security","secret-detection","typosquatting","data-flow-analysis","sarif","github-action","cli","devtools","security-audit","vulnerability-scanner"],"repository":{"type":"git","url":"git+https://github.com/Abanoub-Rodolf/mcp-scan.git"},"description":"Open-source security scanner for Model Context Protocol (MCP) servers. Audits Claude Desktop, VS Code, Cursor, Windsurf, and 12 more AI tools for secrets, prompt injection, supply-chain risks, and 17 security checks.","maintainers":[{"name":"rodolfboctor","email":"rodolf@thynkq.com"}],"readme":"# mcp-scan\n\n[](https://badge.fury.io/js/mcp-scan)\n[](https://www.npmjs.com/package/mcp-scan)\n[](https://opensource.org/licenses/MIT)\n[](https://securityscorecards.dev/viewer/?uri=gitlab.com/abanoub.rodolf/mcp-scan)\n[](https://docs.npmjs.com/generating-provenance-statements)\n[](https://thynkq.com/mcp-scan/check/mcp-scan)\n\n![\"mcp-scan](\"https://raw.githubusercontent.com/Abanoub-Rodolf/mcp-scan/main/assets/demo.gif\")
\n\n**Open-source security scanner for Model Context Protocol (MCP) servers.**\n\nMCP servers run with full access to your filesystem, API keys, and network. mcp-scan audits every MCP server configuration on your system, detecting leaked secrets, prompt injection risks, supply-chain vulnerabilities, and data flow issues before they become incidents.\n\n```bash\nnpx mcp-scan@latest\n```\n\nNo installation. No sign-up. No telemetry. No data leaves your machine. Supply chain scanning makes registry lookups (npm, OSV.dev, GitHub API) - disable with `--offline`.\n\n---\n\n## Badge\n\nPublish an MCP server yourself? Get a public badge for its README:\n\n```bash\nnpx mcp-scan badge \n```\n\nPrints a ready-to-paste Markdown snippet linking to a hosted scan report at thynkq.com. The command itself makes no network calls and needs no account, but the badge image is served by thynkq.com and loads whenever someone views the README. Every scan also prints a public report link for each server it found, whether or not you publish it yourself.\n\n---\n\n## Why mcp-scan?\n\nMCP servers are the new attack surface for AI-powered development. They run silently alongside your AI tools with shell access, filesystem permissions, and network egress. A single malicious or misconfigured server can exfiltrate API keys, inject instructions into your AI sessions, or become a supply-chain entry point.\n\nmcp-scan was built after analyzing hundreds of publicly available MCP server configs and finding patterns that existing security tools miss: credential relay, prompt injection via tool descriptions, typosquatting near popular packages, and data sent to unexpected endpoints.\n\n---\n\n## What It Detects\n\n| Check | Severity | Description |\n|-------|----------|-------------|\n| Data Exfiltration | CRITICAL | Tool reads filesystem/DB/clipboard and sends data to a network endpoint |\n| Credential Relay | HIGH | Environment variables or secrets passed to external APIs or processes |\n| Known Malicious Package | CRITICAL | Config references packages on the known-bad list |\n| Exposed Secret | CRITICAL | Hardcoded API keys, tokens, or passwords in config |\n| Prompt Injection | HIGH | Instructions embedded in tool names, descriptions, or tool schema fields |\n| Obfuscated Network | HIGH | Server uses base64, hex, or reversed URLs to hide endpoints |\n| Data-in-URL Exfil | HIGH | Potential exfiltration via long strings in URL query parameters |\n| Typosquatting | HIGH | Package name closely resembles a trusted popular package |\n| Supply Chain Risk | MEDIUM | Low-trust package with no history, stars, or maintainers |\n| PII Exposure | HIGH | Server handles sensitive personal data without proper controls |\n| Outdated Package | CRITICAL | Package has known vulnerabilities in the installed version |\n| Overly Broad Permissions | HIGH | Server requests filesystem or shell access it does not need |\n| Telemetry Tracking | MEDIUM | Server contacts known analytics or tracking domains |\n| Privacy Gaps | MEDIUM | Missing data retention, deletion, or encryption-at-rest policies |\n| Unverified Source | MEDIUM | Package not from a verified registry or organization, and not published with npm provenance |\n| Data Minimization | LOW | Tool requests significantly more data fields than necessary |\n| Missing Transport | HIGH | MCP server communicates over unencrypted transport |\n\n---\n\n## Supported AI Tools\n\nmcp-scan automatically detects configurations for **17 AI tool clients**:\n\n| Category | Tools |\n|----------|-------|\n| **AI Assistants** | Claude Desktop, Claude Code, Gemini CLI, Codex CLI |\n| **Editors** | VS Code, Cursor, Windsurf, Zed |\n| **AI Coding Tools** | Cline, Roo Code, Continue.dev, Amp, Plandex |\n| **Other** | ChatGPT Desktop, GitHub Copilot, Kiro, Warp |\n\n---\n\n## v2.0 Features\n\n- **Data Flow Analysis**: Trace where your data goes after MCP processes it\n- **Network Egress Monitor**: See every endpoint your servers contact\n- **Privacy Assessment**: One-command PII and compliance report\n- **Policy Engine**: Custom security rules in `.mcp-scan-policy.yml`\n- **Compliance Mapping**: SOC 2, GDPR, HIPAA, PCI-DSS, NIST 800-53\n- **SBOM Generation**: CycloneDX and SPDX output\n- **CI/CD Integration**: Scan on every PR with SARIF output for GitHub, GitLab, and most security tools\n- **16 scanners**: Secrets, supply chain, prompt injection, data flow, and more\n\n---\n\n## All Commands\n\n```bash\n# Full security scan (auto-detects all AI tool configs)\nnpx mcp-scan@latest\n\n# Output as JSON for CI/CD pipelines\nnpx mcp-scan@latest --json\n\n# Privacy impact assessment and data map\nnpx mcp-scan@latest privacy\n\n# Compliance report (SOC 2, GDPR, HIPAA, PCI-DSS, NIST 800-53)\nnpx mcp-scan@latest compliance\n\n# Software Bill of Materials (CycloneDX or SPDX)\nnpx mcp-scan@latest sbom\n\n# Public scan badge and report link for an npm package\nnpx mcp-scan@latest badge \n\n# Validate custom security policies\nnpx mcp-scan@latest policy validate\n\n# CI mode: exit 1 on CRITICAL or HIGH findings (plain scans report without failing)\nnpx mcp-scan@latest --ci --severity high\n\n# Interactive TUI dashboard (blessed/blessed-contrib install as optional\n# dependencies; if the install was skipped, this prints an install hint)\nnpx mcp-scan@latest dashboard\n```\n\n---\n\n## CI/CD Integration\n\nAdd mcp-scan to any CI pipeline via `npx`. Emits SARIF 2.1.0 which GitHub, GitLab, and most security tools pick up:\n\n```yaml\n# GitHub Actions example\nsteps:\n - uses: actions/checkout@v4\n - uses: actions/setup-node@v4\n with:\n node-version: 20\n - run: npx mcp-scan@latest --sarif mcp-scan.sarif --severity medium\n - uses: github/codeql-action/upload-sarif@v3\n with:\n sarif_file: mcp-scan.sarif\n```\n\nGitLab CI, CircleCI, or any runner works. `npx mcp-scan` is the portable entrypoint.\n\n---\n\n## Custom Security Policies\n\nDefine your own rules in `.mcp-scan-policy.yml`:\n\n```yaml\nversion: 1\nrules:\n - id: block-external-secrets\n description: Block any server that leaks secrets to unknown endpoints\n action: block\n match:\n finding_id: [\"exposed-secret\", \"exfiltration-vector\"]\n\n - id: escalate-supply-chain\n description: Treat low-trust packages as critical\n action: override-severity\n severity: critical\n match:\n finding_id: supply-chain-low-trust\n\n - id: allow-local-network\n description: Skip unknown-endpoint findings for local development\n action: skip\n match:\n finding_id: network-egress-unknown\n category: [\"localhost\", \"127.0.0.1\"]\n\n - id: warn-on-pii\n description: Flag any server that handles card data\n action: warn\n match:\n severity: critical\n pii_types: [\"Credit Card\"]\n```\n\nRules need `id` + `action` (`block`, `warn`, `skip`, `override-severity`).\nMatch keys: `server_name`, `finding_id`, `severity`, `category`, `license_type`, `pii_types`.\nValidate with `mcp-scan policy validate`.\n\n---\n\n## Compliance Mapping\n\n| Framework | Controls Covered |\n|-----------|-----------------|\n| SOC 2 | CC6.1, CC6.6, CC6.7, CC7.1 |\n| GDPR | Art. 25, Art. 32, Art. 33 |\n| HIPAA | 164.312(a)(1), 164.312(e)(1) |\n| PCI-DSS | Req. 6, Req. 10, Req. 11 |\n| NIST 800-53 | CA-7, RA-5, SA-11, SI-2 |\n\n---\n\n## Privacy & Security Architecture\n\nmcp-scan runs locally on your machine. Config parsing, regex scanning, and all heuristics happen in-process. The only network calls are optional supply-chain lookups (npm registry, OSV.dev for CVEs, GitHub API for trust scoring), which can be disabled with `--offline`.\n\n- Local config parsing and analysis only\n- No API keys required\n- No telemetry, no account, no sign-up\n- Optional npm/OSV.dev/GitHub API lookups for supply-chain and CVE scanning, off with `--offline`\n- Fully open source. Audit the code yourself.\n\n---\n\n## Roadmap\n\n- **v2.1**: Runtime Monitoring (proxy that inspects live MCP traffic)\n- **v2.2**: Sandboxed Execution for scanned servers\n- **v2.3**: Real-Time Alerting\n\n## Read\n\n- [The State of MCP Security](https://thynkq.com/writing/state-of-mcp-security-2026-08): ecosystem size, real scan data from a workstation and the official registry, and the incidents behind the headlines.\n\n---\n\n## Installation\n\nUse without installing (always latest version):\n\n```bash\nnpx mcp-scan@latest\n```\n\nInstall globally:\n\n```bash\nnpm install -g mcp-scan\nmcp-scan\n```\n\nInstall on macOS via Homebrew:\n\n```bash\nbrew tap Abanoub-Rodolf/mcp-scan\nbrew install mcp-scan\n```\n\n---\n\n## Paid next steps\n\n`mcp-scan` itself is free and MIT. When a scan finds something that needs a\ndecision, two paid options exist. Neither is required to use the scanner:\n\n- **MCP Risk Review**: a human-led, 48-hour review of a real MCP setup by the\n maintainer, with a clear go / fix / escalate recommendation. See\n [thynkq.com/pricing#specialist-review](https://thynkq.com/pricing#specialist-review).\n- **mcp-scan Pro waitlist**: hosted reports, policy packs, and buyer-safe risk\n summaries for teams that need a shareable artifact after a local scan. Join at\n [thynkq.com/products/mcp-scan#mcp-pro-waitlist](https://thynkq.com/products/mcp-scan#mcp-pro-waitlist).\n\n---\n\n## Contributing\n\nIssues and PRs welcome. See [CONTRIBUTING.md](CONTRIBUTING.md) for guidelines.\n\nFor security disclosures: see [SECURITY.md](SECURITY.md).\n\n---\n\n## License\n\nMIT. Built by [Abanoub Rodolf Boctor](https://thynkq.com/about) ยท [ThynkQ](https://thynkq.com)\n","readmeFilename":"README.md"}