This is a fact comparison of five open-source MCP and agent-skill scanners, first published on Agent Security Index. The canonical, updated version is MCP security scanners compared: 5 open-source tools.
Last updated November 2, 2026. Facts come from each project's own README and docs; star counts and release dates were read from GitHub on November 2, 2026. No lab results yet: this is a fact comparison, not a ranking by test score.
Short answer
A scanner checks MCP servers, tools and agent skills before (or outside of) live use. It does not sit in the path of every call the way an MCP gateway does. Which one fits depends on what you want to scan:
- Everything installed on a developer machine (agents, MCP servers and skills): Snyk Agent Scan. It auto-discovers configs for Claude Code, Cursor, Windsurf, Gemini CLI, GitHub Copilot and more. It needs a Snyk API token and sends component details (with secrets redacted) to Snyk's analysis API.
- A specific MCP server, with engines you choose: Cisco MCP Scanner. YARA rules, LLM analysis and the Cisco AI Defense API can run together or alone, and it can scan pre-generated JSON offline for CI.
- Agent skills before you install them: NVIDIA SkillSpector. 71 patterns in 17 categories, an optional LLM pass, a 0-100 risk score and SARIF output.
- MCP server source code and skills as part of a broader red-team platform: Tencent A.I.G, whose MCP and skill scanners also install on their own with pip and write SARIF.
- A quick look at local MCP configs with no account: MCP-Shield runs with npx, but its code has not changed since April 2025.
Comparison table
| Scanner | License | GitHub stars (Nov 2) | Latest release | What it scans | Needs an account or key? |
|---|---|---|---|---|---|
| Snyk Agent Scan | Apache-2.0 | 3,197 | v0.6.10, Oct 30, 2026 | Installed agents, MCP servers, skills | Yes, a Snyk API token |
| Cisco MCP Scanner | Apache-2.0 | 1,106 | 4.8.7, Oct 20, 2026 | MCP tools, prompts, resources, server instructions, server source code | Optional (Cisco AI Defense, LLM, VirusTotal keys) |
| NVIDIA SkillSpector | Apache-2.0 | 23,960 | v2.13.3, Nov 2, 2026 | Agent skills (Git repos, URLs, zips, folders) | Optional (LLM endpoint) |
| Tencent A.I.G | Apache-2.0 | 7,334 | v4.6.8, Oct 29, 2026 | MCP server source or running servers, skills, plus AI infrastructure and models | Not stated for the scanners |
| MCP-Shield | MIT | 555 | No GitHub release (npm 1.0.4) | Installed MCP server configs | Optional (Anthropic API key) |
What to look for in an MCP scanner
Check four things. First, what it actually inspects: tool descriptions only, or also prompts, resources, server source code and skills. Second, whether it starts the servers it scans. Snyk's own README warns that scanning MCP configurations can run commands and make network requests, so scan untrusted configs in a sandbox. Third, where your data goes: some scanners send tool descriptions to a vendor API or an LLM. Fourth, whether the output fits your pipeline (JSON or SARIF for CI).
Scanner by scanner
Snyk Agent Scan (formerly Invariant Labs' mcp-scan). Discovers installed agent components (harnesses, MCP servers and skills) and scans them for prompt injection, sensitive data handling and malware payloads hidden in natural language. Version 0.6 and later detect 14 distinct security risks, per the README. It runs with uvx or as a standalone binary and needs a SNYK_TOKEN. Per the README, it sends component information (agent details, MCP server configurations, tool names and descriptions, skill content) to the Agent Scan API with secrets redacted, and asks for consent before contacting each server in interactive runs. Snyk says the CLI's raw output is experimental and may change. Full listing
Cisco MCP Scanner. A Python tool (3.11+) that scans MCP tools, prompts, resources and server instructions with three engines: YARA rules, LLM-based analysis and the Cisco AI Defense inspect API. It also scans MCP server source code for threats, checks Python dependencies with pip-audit, can check bundled binaries against VirusTotal, and runs as a CLI or a REST API server. Static mode scans pre-generated JSON files without connecting to a live server, for CI and air-gapped use. All three API keys are optional. Full listing
NVIDIA SkillSpector. Scans AI agent skills (for Claude Code, Codex CLI, Gemini CLI and others) before you install them. It checks Git repos, URLs, zip files or folders against 71 vulnerability patterns in 17 categories, including MCP least privilege and MCP tool poisoning, with fast static analysis and an optional LLM pass. Output is terminal, JSON, Markdown or SARIF, with a 0-100 risk score. NVIDIA uses it in its Verified Skills pipeline. Full listing
Tencent A.I.G (AI-Infra-Guard). An AI red-teaming platform from Tencent Zhuque Lab. Its MCP scan checks an MCP server source directory or connects to a running service; its skill scan audits a local skill directory. Since v4.6.8 both install on their own with pip (aig-mcp-scan, aig-skill-scan) and write SARIF. The project says the web platform has no authentication and should not be exposed on public networks. Full listing
MCP-Shield. Scans installed MCP server configs for tool poisoning, exfiltration channels and cross-origin escalations, with an optional Anthropic API key for AI analysis. It can identify as a different client to spot servers that behave differently by client. Last code change April 26, 2025, so treat it as unmaintained. Full listing
Scanner or gateway?
A scanner tells you what is risky before you connect. A gateway enforces rules on every call after you connect. Most teams that run MCP in production need both. Compare gateways in The best open-source MCP gateways in 2026, or see everything in MCP gateways and scanners.
FAQ
What is the best free MCP security scanner?
All five on this page are free and open source. For scanning everything installed on a developer machine, Snyk Agent Scan (needs a free Snyk API token). For one MCP server, Cisco MCP Scanner. For agent skills, NVIDIA SkillSpector.
Do MCP scanners send my data anywhere?
Some do. Snyk Agent Scan sends component details such as tool names, descriptions and skill content to Snyk's analysis API, with secrets redacted, per its README. Cisco MCP Scanner, SkillSpector and MCP-Shield send data to an outside service only if you turn on their optional API or LLM analysis.
Is MCP-Shield still maintained?
Its GitHub repo has had no code change since April 26, 2025. See the MCP-Shield listing.
Has Agent Security Index tested these?
Not yet. No lab results have been published. This page compares verified facts only.
Sources checked on November 2, 2026
- Snyk Agent Scan: https://github.com/snyk/agent-scan (README) and https://github.com/snyk/agent-scan/releases
- Cisco MCP Scanner: https://github.com/cisco-ai-defense/mcp-scanner (README) and https://pypi.org/project/cisco-ai-mcp-scanner/
- NVIDIA SkillSpector: https://github.com/NVIDIA/SkillSpector (README) and https://docs.nvidia.com/skills/scanning-agent-skills
- Tencent A.I.G: https://github.com/Tencent/AI-Infra-Guard (README) and https://github.com/Tencent/AI-Infra-Guard/releases/tag/v4.6.8
- MCP-Shield: https://github.com/riseandignite/mcp-shield (README) and https://www.npmjs.com/package/mcp-shield
- Star counts, licenses and release dates: GitHub API, read November 2, 2026
A regularly updated version of this comparison lives at agentsecurityindex.com/compare/mcp-security-scanners/.
Top comments (0)