Why Your AI Agent's Tools Deserve the Same Scrutiny as Your npm Dependencies

Lucas Bissi — Mon, 07 Sep 2026 21:18:56 +0000

In recent years, npm has completely changed the way we build software. Instead of building everything from scratch, we started installing libraries created by third parties and reusing ready-made solutions.

This accelerated development, but it also brought a major security challenge: every package we install adds third-party code to our software supply chain. Cases of malicious packages, typosquatting, and compromised dependencies have shown that just because something is popular or useful doesn't mean it's safe.

I believe we're starting to see something similar happen with the growth of MCP.

What is MCP, and why does it matter?

The Model Context Protocol emerged to standardize how AI models connect to tools, data, and external systems. Its adoption has grown rapidly, and along with it, an ever-expanding ecosystem of MCP Servers and Agent Skills ready to be plugged into agents.

And this is where my concern comes in: we're starting to connect third-party tools to agents capable of accessing data, executing commands, and interacting with real systems.

Introducing mcpscan

With that in mind, I built mcpscan, a security scanner for MCP Servers and Agent Skills.

The project analyzes risks such as:

Tool poisoning
Hidden instructions using invisible Unicode characters
Command injection
Exposed credentials
Insecure schemas
Remote code execution
Potential exfiltration behaviors

Detecting an attack ≠ writing a good rule

One of the most interesting parts of building this was realizing that creating a rule capable of detecting an attack doesn't necessarily mean creating a good rule. During calibration, some detections that seemed effective had to be modified or discarded because they generated false positives on legitimate code.

Where the project stands today

Currently, mcpscan has:

16 security rules
1,100+ tests
CI/CD integration and GitHub Actions support
JSON and SARIF output support
Runtime analysis of MCP Servers, inspecting the tools they actually expose

The core idea

mcpscan is still evolving, but the idea behind it is simple:

If we've learned that we can't install just any npm package without thinking about dependency chain security, maybe it's time to start asking the same question before connecting any tool to an AI agent.

Do we really know what it's doing?

Check it out on GitHub: github.com/Luked20/mcpscan