English Français العربية

MCPAmpel - MCP Security Scanner

Official registry Security

Scan installed MCP servers for security vulnerabilities with 16 detection engines.

Source code Documentation

Install

Add this to your client's MCP configuration (Claude Desktop: claude_desktop_config.json; Cursor: .cursor/mcp.json; VS Code and others use the same "mcpServers" shape).

PYPI package mcpampel
Claude Code 
claude mcp add mcpampel-mcp-security-scanner -e 'MCPAMPEL_API_KEY=<your mcpampel_api_key>' -- uvx mcpampel==0.2.2
JSON configuration (Claude Desktop, Cursor, VS Code) 
{
    "mcpServers": {
        "mcpampel-mcp-security-scanner": {
            "command": "uvx",
            "args": [
                "mcpampel==0.2.2"
            ],
            "env": {
                "MCPAMPEL_API_KEY": "<your mcpampel_api_key>"
            }
        }
    }
}

Environment variables

  • MCPAMPEL_API_KEY required secret MCPAmpel API key (get one free at mcpampel.com)

Documentation

From the project's README on GitHub, refreshed weekly. Links open on GitHub.

Contents
  1. MCPAmpel - MCP Security Scanner
  2. Quick Start
  3. Configuration
  4. Tools
  5. Development
  6. License

MCPAmpel - MCP Security Scanner

Scan your installed MCP servers for security vulnerabilities, directly from your AI agent.

MCPAmpel discovers MCP servers from your Claude Code, Cursor, Windsurf, or Gemini CLI configuration, submits them to 16 scanning engines, and returns an aggregated trust score with detailed findings.

50 API calls/day included.

Quick Start

uvx mcpampel

Configuration

Claude Code / Claude Desktop

Add to ~/.claude/settings.json or claude_desktop_config.json:

{
  "mcpServers": {
    "mcpampel": {
      "command": "uvx",
      "args": ["mcpampel"],
      "env": {
        "MCPAMPEL_API_KEY": "your_key_here"
      }
    }
  }
}
Cursor

Add to ~/.cursor/mcp.json:

{
  "mcpServers": {
    "mcpampel": {
      "command": "uvx",
      "args": ["mcpampel"],
      "env": {
        "MCPAMPEL_API_KEY": "your_key_here"
      }
    }
  }
}
Windsurf

Add to ~/.codeium/windsurf/mcp_config.json:

{
  "mcpServers": {
    "mcpampel": {
      "command": "uvx",
      "args": ["mcpampel"],
      "env": {
        "MCPAMPEL_API_KEY": "your_key_here"
      }
    }
  }
}
Gemini CLI

Add to ~/.gemini/settings.json:

{
  "mcpServers": {
    "mcpampel": {
      "command": "uvx",
      "args": ["mcpampel"],
      "env": {
        "MCPAMPEL_API_KEY": "your_key_here"
      }
    }
  }
}
Getting an API Key

Register for free at mcpampel.com.

Environment Variables
VariableRequiredDefaultDescription
MCPAMPEL_API_KEYYes-Your API key (free at mcpampel.com)
MCPAMPEL_BASE_URLNohttps://mcpampel.comAPI base URL

Tools

scan_my_servers

Discovers all MCP servers from your editor config and scans them with 16 engines. Returns a summary table with trust scores. No input needed.

scan_url

Scan a single GitHub, GitLab, npm, or PyPI URL. Returns trust score, engine breakdown, and findings.

ParameterTypeRequired
urlstringYes
check_status

Show your daily quota usage and remaining scans.

get_scan_results

Get detailed results for a specific scan by ID. Use after scan_my_servers or scan_url to drill into findings.

ParameterTypeRequired
scan_idstringYes

Development

cd mcp-plugin
uv sync
uv run pytest

License

Apache License 2.0

mcpampel.com

Frequently asked questions

What is MCPAmpel - MCP Security Scanner?

Scan installed MCP servers for security vulnerabilities with 16 detection engines.

How do I install MCPAmpel - MCP Security Scanner?

It runs on your machine. In Claude Code: claude mcp add mcpampel-mcp-security-scanner -e 'MCPAMPEL_API_KEY=<your mcpampel_api_key>' -- uvx mcpampel==0.2.2. For other clients, paste the JSON configuration from this page into their MCP settings.

Does MCPAmpel - MCP Security Scanner need an API key?

Yes. It expects MCPAMPEL_API_KEY, which you set in its configuration.

Is MCPAmpel - MCP Security Scanner open source?

Yes. Its code is on GitHub under the Apache-2.0 license.

Who maintains MCPAmpel - MCP Security Scanner?

It is published by MCPAmpel. AI.tn lists it but does not maintain or endorse it.

From the official MCP Registry. Listing is not an endorsement: review a server's code and permissions before giving it access to your data.