Introduction

Aevrin scans Model Context Protocol (MCP) servers for security risks before you trust them, whether that is a source repository, a local path on your machine, or a live server URL. It runs a fixed set of established open-source scanners (Semgrep, Bandit, Gitleaks, TruffleHog, OSV-Scanner, Trivy, OpenSSF Scorecard, mcp-shield, and the official MCP SDK) and maps every result onto the OWASP MCP Top 10, so a finding means the same thing everywhere it appears: in the CLI, in a Claude Code hook block, and on the dashboard.

The three ways to use it

CLI

aevrin scan <target> runs every scanner locally and gives you a full report in your terminal.

Claude Code hook

Blocks claude mcp add and MCP config writes automatically when a server has unresolved high or critical findings, before Claude ever installs it.

Dashboard

Every scan (CLI or hook-triggered) is saved to your account at mcp.aevrin.net, with full findings, stage-by-stage detail, and an OWASP MCP-mapped report export on paid tiers.

Quick start

pipx install aevrin
aevrin login
aevrin scan https://github.com/owner/mcp-server

See Getting Started for the full walkthrough, including installing on older Python versions and connecting the Claude Code hook.

What a scan actually checks

A repository or local-path scan clones (or reads) the target and runs, in order:

Static analysis. Semgrep and Bandit for injection, path traversal, SSRF, and other code-level risks.
Secrets. Gitleaks and TruffleHog for hardcoded credentials, with TruffleHog additionally verifying whether a matched credential is actually live.
Dependencies. OSV-Scanner and Trivy for known-vulnerable packages, plus OpenSSF Scorecard if you've set a GITHUB_TOKEN.
Tool description check. mcp-shield and safe, remote-only MCP SDK inspection read the server's declared MCP tools for hidden-instruction (tool poisoning) and prompt-injection patterns, and Aevrin's own rules check for weak/missing auth and audit logging.

A live-server URL or a pasted MCP config skips the code-level stages (nothing to clone) and only gets the tool-description check. See Concepts for why.

Honesty over false confidence

Two things Aevrin is deliberately strict about, because a security scanner that can be tricked into saying "clean" is worse than no scanner at all:

Incomplete scans are never reported as clean. If Docker isn't running, a scanner binary is missing, or the network is unreachable, the affected category is marked unreliable and the scan is flagged incomplete everywhere: CLI exit code, hook decision, and dashboard badge. An empty findings list from a category that never ran is not the same thing as a clean one.
Not everything is tested. Prompt injection via a live tool's runtime responses (MCP08) requires dynamic, adversarial testing against a running server and is out of scope for static scanning. Every report says so explicitly rather than silently omitting it.