MCP-Audit

MCP-Audit/MCTS

MCTS (Model Context Threat Scanner) is a local-first security scanner for MCP servers -- static and live tool discovery, multiple analyzers, auditable risk scores, and JSON, SARIF, and HTML output. For authors and platform teams; CI-ready, no cloud API.

28 stars 15 forks 28 watchers Python Apache License 2.0

ai-agents ai-agents-security ai-safety mcp mcp-audit mcp-security-testing mcp-server model-context-protocol security starify

53 Open Issues Need Help Last updated: Jun 29, 2026

Open Issues Need Help

View All on GitHub

[TASK] Whitelist localhost and dev URLs in data-leakage analyzer about 2 hours ago

good first issue component:sast finding:false-positive priority:P2 status:ready type:task

28

MCTS (Model Context Threat Scanner) is a local-first security scanner for MCP servers -- static and live tool discovery, multiple analyzers, auditable risk scores, and JSON, SARIF, and HTML output. For authors and platform teams; CI-ready, no cloud API.

Python

#ai-agents#ai-agents-security#ai-safety#mcp#mcp-audit#mcp-security-testing#mcp-server#model-context-protocol#security#starify

[SECURITY] `mcts inventory` reads local MCP configs without consent gate 26 days ago

help wanted component:inventory finding:privacy priority:P2 status:in-progress type:security

28

MCTS (Model Context Threat Scanner) is a local-first security scanner for MCP servers -- static and live tool discovery, multiple analyzers, auditable risk scores, and JSON, SARIF, and HTML output. For authors and platform teams; CI-ready, no cloud API.

Python

#ai-agents#ai-agents-security#ai-safety#mcp#mcp-audit#mcp-security-testing#mcp-server#model-context-protocol#security#starify

[FEATURE] Phase 3 CLI: `mcts simulate` and remaining roadmap commands 27 days ago

help wanted phase-3 component:cli priority:P3 status:ready type:feature

28

MCTS (Model Context Threat Scanner) is a local-first security scanner for MCP servers -- static and live tool discovery, multiple analyzers, auditable risk scores, and JSON, SARIF, and HTML output. For authors and platform teams; CI-ready, no cloud API.

Python

#ai-agents#ai-agents-security#ai-safety#mcp#mcp-audit#mcp-security-testing#mcp-server#model-context-protocol#security#starify

[FEATURE] Categorize live MCP startup failures (credentials vs timeout vs config) 27 days ago

good first issue component:live-probe priority:P2 status:blocked type:feature

28

MCTS (Model Context Threat Scanner) is a local-first security scanner for MCP servers -- static and live tool discovery, multiple analyzers, auditable risk scores, and JSON, SARIF, and HTML output. For authors and platform teams; CI-ready, no cloud API.

Python

#ai-agents#ai-agents-security#ai-safety#mcp#mcp-audit#mcp-security-testing#mcp-server#model-context-protocol#security#starify

[DOCS] Improve --fail-on-category help text with inclusive threshold examples about 1 month ago

good first issue component:cli priority:P2 status:ready type:docs

28

MCTS (Model Context Threat Scanner) is a local-first security scanner for MCP servers -- static and live tool discovery, multiple analyzers, auditable risk scores, and JSON, SARIF, and HTML output. For authors and platform teams; CI-ready, no cloud API.

Python

#ai-agents#ai-agents-security#ai-safety#mcp#mcp-audit#mcp-security-testing#mcp-server#model-context-protocol#security#starify

[DOCS] Document pentest static-only limits when zero tools are discovered about 1 month ago

good first issue component:live-probe priority:P2 status:ready type:docs

28

MCTS (Model Context Threat Scanner) is a local-first security scanner for MCP servers -- static and live tool discovery, multiple analyzers, auditable risk scores, and JSON, SARIF, and HTML output. For authors and platform teams; CI-ready, no cloud API.

Python

#ai-agents#ai-agents-security#ai-safety#mcp#mcp-audit#mcp-security-testing#mcp-server#model-context-protocol#security#starify

[DOCS] Document category gate vs --ci min-score gate semantics about 1 month ago

good first issue component:cli priority:P2 status:ready type:docs

28

MCTS (Model Context Threat Scanner) is a local-first security scanner for MCP servers -- static and live tool discovery, multiple analyzers, auditable risk scores, and JSON, SARIF, and HTML output. For authors and platform teams; CI-ready, no cloud API.

Python

#ai-agents#ai-agents-security#ai-safety#mcp#mcp-audit#mcp-security-testing#mcp-server#model-context-protocol#security#starify

[DOCS] Document that static --config mode does not execute server launch args about 1 month ago

good first issue component:cli priority:P2 status:ready type:docs

28

MCTS (Model Context Threat Scanner) is a local-first security scanner for MCP servers -- static and live tool discovery, multiple analyzers, auditable risk scores, and JSON, SARIF, and HTML output. For authors and platform teams; CI-ready, no cloud API.

Python

#ai-agents#ai-agents-security#ai-safety#mcp#mcp-audit#mcp-security-testing#mcp-server#model-context-protocol#security#starify

[FEATURE] Doctor: surface -m module.bridge entrypoints from .mcp.json about 1 month ago

good first issue component:cli priority:P2 status:ready type:feature

28

MCTS (Model Context Threat Scanner) is a local-first security scanner for MCP servers -- static and live tool discovery, multiple analyzers, auditable risk scores, and JSON, SARIF, and HTML output. For authors and platform teams; CI-ready, no cloud API.

Python

#ai-agents#ai-agents-security#ai-safety#mcp#mcp-audit#mcp-security-testing#mcp-server#model-context-protocol#security#starify

[FEATURE] Clarify --fail-on-category error when score equals inclusive limit about 1 month ago

good first issue component:cli priority:P2 status:ready type:feature

28

MCTS (Model Context Threat Scanner) is a local-first security scanner for MCP servers -- static and live tool discovery, multiple analyzers, auditable risk scores, and JSON, SARIF, and HTML output. For authors and platform teams; CI-ready, no cloud API.

Python

#ai-agents#ai-agents-security#ai-safety#mcp#mcp-audit#mcp-security-testing#mcp-server#model-context-protocol#security#starify

[TASK] Deduplicate instruction findings across archive copies about 1 month ago

good first issue component:sast finding:performance priority:P2 status:ready type:task

28

MCTS (Model Context Threat Scanner) is a local-first security scanner for MCP servers -- static and live tool discovery, multiple analyzers, auditable risk scores, and JSON, SARIF, and HTML output. For authors and platform teams; CI-ready, no cloud API.

Python

#ai-agents#ai-agents-security#ai-safety#mcp#mcp-audit#mcp-security-testing#mcp-server#model-context-protocol#security#starify

[TASK] Separate build-system dependencies from runtime in supply-chain scan about 1 month ago

good first issue component:sast finding:supply-chain priority:P2 status:ready type:task

28

MCTS (Model Context Threat Scanner) is a local-first security scanner for MCP servers -- static and live tool discovery, multiple analyzers, auditable risk scores, and JSON, SARIF, and HTML output. For authors and platform teams; CI-ready, no cloud API.

Python

#ai-agents#ai-agents-security#ai-safety#mcp#mcp-audit#mcp-security-testing#mcp-server#model-context-protocol#security#starify

[TASK] Skill scanner: do not flag markdown citation links as fetch commands about 1 month ago

good first issue component:sast finding:false-positive priority:P1 status:ready type:task

28

MCTS (Model Context Threat Scanner) is a local-first security scanner for MCP servers -- static and live tool discovery, multiple analyzers, auditable risk scores, and JSON, SARIF, and HTML output. For authors and platform teams; CI-ready, no cloud API.

Python

#ai-agents#ai-agents-security#ai-safety#mcp#mcp-audit#mcp-security-testing#mcp-server#model-context-protocol#security#starify

[BUG] Infinite loop semantic risk fires on normal search/recall tools about 1 month ago

good first issue component:sast finding:false-positive priority:P2 status:ready type:bug

28

MCTS (Model Context Threat Scanner) is a local-first security scanner for MCP servers -- static and live tool discovery, multiple analyzers, auditable risk scores, and JSON, SARIF, and HTML output. For authors and platform teams; CI-ready, no cloud API.

Python

#ai-agents#ai-agents-security#ai-safety#mcp#mcp-audit#mcp-security-testing#mcp-server#model-context-protocol#security#starify

[TASK] Deduplicate prompt findings by content hash across files about 1 month ago

good first issue component:cli finding:performance priority:P2 status:ready type:task

28

MCTS (Model Context Threat Scanner) is a local-first security scanner for MCP servers -- static and live tool discovery, multiple analyzers, auditable risk scores, and JSON, SARIF, and HTML output. For authors and platform teams; CI-ready, no cloud API.

Python

#ai-agents#ai-agents-security#ai-safety#mcp#mcp-audit#mcp-security-testing#mcp-server#model-context-protocol#security#starify

[BUG] Semantic analyzer falsely detects subprocess/exec in clean code about 1 month ago

help wanted component:sast finding:false-positive priority:P2 status:ready type:bug

28

MCTS (Model Context Threat Scanner) is a local-first security scanner for MCP servers -- static and live tool discovery, multiple analyzers, auditable risk scores, and JSON, SARIF, and HTML output. For authors and platform teams; CI-ready, no cloud API.

Python

#ai-agents#ai-agents-security#ai-safety#mcp#mcp-audit#mcp-security-testing#mcp-server#model-context-protocol#security#starify

[TASK] Skill scanner: ignore example 'password' mentions in documentation about 1 month ago

good first issue component:sast finding:false-positive priority:P1 status:ready type:task

28

MCTS (Model Context Threat Scanner) is a local-first security scanner for MCP servers -- static and live tool discovery, multiple analyzers, auditable risk scores, and JSON, SARIF, and HTML output. For authors and platform teams; CI-ready, no cloud API.

Python

#ai-agents#ai-agents-security#ai-safety#mcp#mcp-audit#mcp-security-testing#mcp-server#model-context-protocol#security#starify

[TASK] Deduplicate findings before calculating pentest verdict about 1 month ago

good first issue component:live-probe finding:false-positive priority:P2 status:ready type:task

28

MCTS (Model Context Threat Scanner) is a local-first security scanner for MCP servers -- static and live tool discovery, multiple analyzers, auditable risk scores, and JSON, SARIF, and HTML output. For authors and platform teams; CI-ready, no cloud API.

Python

#ai-agents#ai-agents-security#ai-safety#mcp#mcp-audit#mcp-security-testing#mcp-server#model-context-protocol#security#starify

[BUG] Path traversal flag on database key-value lookup, not filesystem access (false positive) about 1 month ago

good first issue component:sast finding:false-positive priority:P2 status:ready type:bug

28

MCTS (Model Context Threat Scanner) is a local-first security scanner for MCP servers -- static and live tool discovery, multiple analyzers, auditable risk scores, and JSON, SARIF, and HTML output. For authors and platform teams; CI-ready, no cloud API.

Python

#ai-agents#ai-agents-security#ai-safety#mcp#mcp-audit#mcp-security-testing#mcp-server#model-context-protocol#security#starify

[TASK] Treat @main git refs as riskier than tagged or commit pins about 1 month ago

good first issue component:sast finding:false-negative finding:supply-chain priority:P2 status:ready type:task

28

MCTS (Model Context Threat Scanner) is a local-first security scanner for MCP servers -- static and live tool discovery, multiple analyzers, auditable risk scores, and JSON, SARIF, and HTML output. For authors and platform teams; CI-ready, no cloud API.

Python

#ai-agents#ai-agents-security#ai-safety#mcp#mcp-audit#mcp-security-testing#mcp-server#model-context-protocol#security#starify

[BUG] Internal URL detection fires on console print() statements (false positive) about 1 month ago

good first issue component:sast finding:false-positive priority:P2 status:ready type:bug

28

MCTS (Model Context Threat Scanner) is a local-first security scanner for MCP servers -- static and live tool discovery, multiple analyzers, auditable risk scores, and JSON, SARIF, and HTML output. For authors and platform teams; CI-ready, no cloud API.

Python

#ai-agents#ai-agents-security#ai-safety#mcp#mcp-audit#mcp-security-testing#mcp-server#model-context-protocol#security#starify

[BUG] False positives: prompt templates and SKILL.md files flagged as injection surfaces about 1 month ago

good first issue component:sast finding:false-positive priority:P2 status:ready type:bug

28

MCTS (Model Context Threat Scanner) is a local-first security scanner for MCP servers -- static and live tool discovery, multiple analyzers, auditable risk scores, and JSON, SARIF, and HTML output. For authors and platform teams; CI-ready, no cloud API.

Python

#ai-agents#ai-agents-security#ai-safety#mcp#mcp-audit#mcp-security-testing#mcp-server#model-context-protocol#security#starify

[BUG] Fuzz runner silently ignores tool discovery failures about 1 month ago

good first issue component:fuzz priority:P2 status:ready type:bug

28

MCTS (Model Context Threat Scanner) is a local-first security scanner for MCP servers -- static and live tool discovery, multiple analyzers, auditable risk scores, and JSON, SARIF, and HTML output. For authors and platform teams; CI-ready, no cloud API.

Python

#ai-agents#ai-agents-security#ai-safety#mcp#mcp-audit#mcp-security-testing#mcp-server#model-context-protocol#security#starify

[TASK] pip-audit/npm-audit silently skip when tools missing or flags off about 1 month ago

good first issue component:sast finding:supply-chain priority:P2 status:ready type:task

28

MCTS (Model Context Threat Scanner) is a local-first security scanner for MCP servers -- static and live tool discovery, multiple analyzers, auditable risk scores, and JSON, SARIF, and HTML output. For authors and platform teams; CI-ready, no cloud API.

Python

#ai-agents#ai-agents-security#ai-safety#mcp#mcp-audit#mcp-security-testing#mcp-server#model-context-protocol#security#starify

[TASK] TypeScript tree-sitter path does not verify param-to-sink data flow about 1 month ago

help wanted component:sast finding:false-negative priority:P2 status:ready type:task

28

MCTS (Model Context Threat Scanner) is a local-first security scanner for MCP servers -- static and live tool discovery, multiple analyzers, auditable risk scores, and JSON, SARIF, and HTML output. For authors and platform teams; CI-ready, no cloud API.

Python

#ai-agents#ai-agents-security#ai-safety#mcp#mcp-audit#mcp-security-testing#mcp-server#model-context-protocol#security#starify

[TASK] Protocol probes (MCPS-002/003) may false-positive on public endpoints about 1 month ago

help wanted component:sast finding:false-positive priority:P2 status:ready type:task

28

MCTS (Model Context Threat Scanner) is a local-first security scanner for MCP servers -- static and live tool discovery, multiple analyzers, auditable risk scores, and JSON, SARIF, and HTML output. For authors and platform teams; CI-ready, no cloud API.

Python

#ai-agents#ai-agents-security#ai-safety#mcp#mcp-audit#mcp-security-testing#mcp-server#model-context-protocol#security#starify

[FEATURE] `mcts audit-config` command not implemented about 1 month ago

help wanted component:cli component:inventory priority:P2 status:ready type:feature

28

MCTS (Model Context Threat Scanner) is a local-first security scanner for MCP servers -- static and live tool discovery, multiple analyzers, auditable risk scores, and JSON, SARIF, and HTML output. For authors and platform teams; CI-ready, no cloud API.

Python

#ai-agents#ai-agents-security#ai-safety#mcp#mcp-audit#mcp-security-testing#mcp-server#model-context-protocol#security#starify

[TASK] Improve generic secret detection for exposed AI development tool credentials about 1 month ago

bug good first issue component:sast finding:supply-chain priority:P2 status:ready type:task

28

MCTS (Model Context Threat Scanner) is a local-first security scanner for MCP servers -- static and live tool discovery, multiple analyzers, auditable risk scores, and JSON, SARIF, and HTML output. For authors and platform teams; CI-ready, no cloud API.

Python

#ai-agents#ai-agents-security#ai-safety#mcp#mcp-audit#mcp-security-testing#mcp-server#model-context-protocol#security#starify

[TASK] Exclude requires-python from supply-chain dependency findings about 1 month ago

good first issue component:sast finding:false-positive finding:supply-chain priority:P2 status:blocked type:task

28

MCTS (Model Context Threat Scanner) is a local-first security scanner for MCP servers -- static and live tool discovery, multiple analyzers, auditable risk scores, and JSON, SARIF, and HTML output. For authors and platform teams; CI-ready, no cloud API.

Python

#ai-agents#ai-agents-security#ai-safety#mcp#mcp-audit#mcp-security-testing#mcp-server#model-context-protocol#security#starify

[BUG] Deduplicate duplicate Docker FROM findings in supply-chain scan about 1 month ago

good first issue component:sast finding:false-positive finding:supply-chain priority:P2 status:blocked type:bug

28

MCTS (Model Context Threat Scanner) is a local-first security scanner for MCP servers -- static and live tool discovery, multiple analyzers, auditable risk scores, and JSON, SARIF, and HTML output. For authors and platform teams; CI-ready, no cloud API.

Python

#ai-agents#ai-agents-security#ai-safety#mcp#mcp-audit#mcp-security-testing#mcp-server#model-context-protocol#security#starify

[FEATURE] Remote protocol fuzz (`mcts fuzz --url`) not supported about 1 month ago

help wanted component:fuzz priority:P2 type:feature status:on-hold

28

MCTS (Model Context Threat Scanner) is a local-first security scanner for MCP servers -- static and live tool discovery, multiple analyzers, auditable risk scores, and JSON, SARIF, and HTML output. For authors and platform teams; CI-ready, no cloud API.

Python

#ai-agents#ai-agents-security#ai-safety#mcp#mcp-audit#mcp-security-testing#mcp-server#model-context-protocol#security#starify

Reject invalid snapshot JSON (e.g. scan reports passed as tools/list) about 1 month ago

good first issue priority:P0 type:bug component:snapshot status:on-hold

28

MCTS (Model Context Threat Scanner) is a local-first security scanner for MCP servers -- static and live tool discovery, multiple analyzers, auditable risk scores, and JSON, SARIF, and HTML output. For authors and platform teams; CI-ready, no cloud API.

Python

#ai-agents#ai-agents-security#ai-safety#mcp#mcp-audit#mcp-security-testing#mcp-server#model-context-protocol#security#starify

scan-resources should not include prompt-surface findings about 1 month ago

good first issue component:cli priority:P2 type:bug status:on-hold

28

MCTS (Model Context Threat Scanner) is a local-first security scanner for MCP servers -- static and live tool discovery, multiple analyzers, auditable risk scores, and JSON, SARIF, and HTML output. For authors and platform teams; CI-ready, no cloud API.

Python

#ai-agents#ai-agents-security#ai-safety#mcp#mcp-audit#mcp-security-testing#mcp-server#model-context-protocol#security#starify

Doctor should verify optional extras ([mcp], [api]) and semgrep on PATH about 1 month ago

good first issue priority:P2 status:ready component:doctor type:enhancement

28

MCTS (Model Context Threat Scanner) is a local-first security scanner for MCP servers -- static and live tool discovery, multiple analyzers, auditable risk scores, and JSON, SARIF, and HTML output. For authors and platform teams; CI-ready, no cloud API.

Python

#ai-agents#ai-agents-security#ai-safety#mcp#mcp-audit#mcp-security-testing#mcp-server#model-context-protocol#security#starify

Fail fast when --policy file is missing before running scan about 1 month ago

good first issue component:cli priority:P2 status:ready type:enhancement

28

MCTS (Model Context Threat Scanner) is a local-first security scanner for MCP servers -- static and live tool discovery, multiple analyzers, auditable risk scores, and JSON, SARIF, and HTML output. For authors and platform teams; CI-ready, no cloud API.

Python

#ai-agents#ai-agents-security#ai-safety#mcp#mcp-audit#mcp-security-testing#mcp-server#model-context-protocol#security#starify

Improve mcts vet error when PyPI version genuinely not found about 1 month ago

good first issue priority:P2 status:ready component:vet type:enhancement

28

MCTS (Model Context Threat Scanner) is a local-first security scanner for MCP servers -- static and live tool discovery, multiple analyzers, auditable risk scores, and JSON, SARIF, and HTML output. For authors and platform teams; CI-ready, no cloud API.

Python

#ai-agents#ai-agents-security#ai-safety#mcp#mcp-audit#mcp-security-testing#mcp-server#model-context-protocol#security#starify

Validate launch config before live consent gate on snapshot and fuzz about 1 month ago

good first issue priority:P2 status:ready component:snapshot type:enhancement

28

MCTS (Model Context Threat Scanner) is a local-first security scanner for MCP servers -- static and live tool discovery, multiple analyzers, auditable risk scores, and JSON, SARIF, and HTML output. For authors and platform teams; CI-ready, no cloud API.

Python

#ai-agents#ai-agents-security#ai-safety#mcp#mcp-audit#mcp-security-testing#mcp-server#model-context-protocol#security#starify

Use per-subcommand output paths for scan-prompts/resources/instructions about 1 month ago

good first issue component:cli priority:P2 status:ready type:enhancement

28

MCTS (Model Context Threat Scanner) is a local-first security scanner for MCP servers -- static and live tool discovery, multiple analyzers, auditable risk scores, and JSON, SARIF, and HTML output. For authors and platform teams; CI-ready, no cloud API.

Python

#ai-agents#ai-agents-security#ai-safety#mcp#mcp-audit#mcp-security-testing#mcp-server#model-context-protocol#security#starify

Doctor --deep should explain when deep checks are skipped about 1 month ago

good first issue priority:P2 status:ready component:doctor type:enhancement

28

MCTS (Model Context Threat Scanner) is a local-first security scanner for MCP servers -- static and live tool discovery, multiple analyzers, auditable risk scores, and JSON, SARIF, and HTML output. For authors and platform teams; CI-ready, no cloud API.

Python

#ai-agents#ai-agents-security#ai-safety#mcp#mcp-audit#mcp-security-testing#mcp-server#model-context-protocol#security#starify

Suppress OWASP MCP gap finding when tool discovery failed about 1 month ago

good first issue priority:P2 status:ready component:compliance type:enhancement

28

MCTS (Model Context Threat Scanner) is a local-first security scanner for MCP servers -- static and live tool discovery, multiple analyzers, auditable risk scores, and JSON, SARIF, and HTML output. For authors and platform teams; CI-ready, no cloud API.

Python

#ai-agents#ai-agents-security#ai-safety#mcp#mcp-audit#mcp-security-testing#mcp-server#model-context-protocol#security#starify

Lead CI output with score component breakdown (MCP Surface vs Dep Hygiene) about 1 month ago

good first issue priority:P2 status:ready component:scoring type:enhancement

28

MCTS (Model Context Threat Scanner) is a local-first security scanner for MCP servers -- static and live tool discovery, multiple analyzers, auditable risk scores, and JSON, SARIF, and HTML output. For authors and platform teams; CI-ready, no cloud API.

Python

#ai-agents#ai-agents-security#ai-safety#mcp#mcp-audit#mcp-security-testing#mcp-server#model-context-protocol#security#starify

Allow mcts scan --url without an explicit TARGET positional argument about 1 month ago

good first issue component:cli priority:P1 status:ready type:enhancement

28

MCTS (Model Context Threat Scanner) is a local-first security scanner for MCP servers -- static and live tool discovery, multiple analyzers, auditable risk scores, and JSON, SARIF, and HTML output. For authors and platform teams; CI-ready, no cloud API.

Python

#ai-agents#ai-agents-security#ai-safety#mcp#mcp-audit#mcp-security-testing#mcp-server#model-context-protocol#security#starify

Improve --auto behavior for multi-server MCP configs about 1 month ago

good first issue component:cli priority:P1 status:ready type:enhancement

28

MCTS (Model Context Threat Scanner) is a local-first security scanner for MCP servers -- static and live tool discovery, multiple analyzers, auditable risk scores, and JSON, SARIF, and HTML output. For authors and platform teams; CI-ready, no cloud API.

Python

#ai-agents#ai-agents-security#ai-safety#mcp#mcp-audit#mcp-security-testing#mcp-server#model-context-protocol#security#starify

Warn or fail readiness when --opa/--llm-judge flags set but deps missing about 1 month ago

good first issue priority:P1 status:ready component:readiness type:enhancement

28

MCTS (Model Context Threat Scanner) is a local-first security scanner for MCP servers -- static and live tool discovery, multiple analyzers, auditable risk scores, and JSON, SARIF, and HTML output. For authors and platform teams; CI-ready, no cloud API.

Python

#ai-agents#ai-agents-security#ai-safety#mcp#mcp-audit#mcp-security-testing#mcp-server#model-context-protocol#security#starify

Log pip-audit skip reason and surface CVE findings in report about 1 month ago

good first issue component:cli priority:P1 status:ready type:enhancement

28

MCTS (Model Context Threat Scanner) is a local-first security scanner for MCP servers -- static and live tool discovery, multiple analyzers, auditable risk scores, and JSON, SARIF, and HTML output. For authors and platform teams; CI-ready, no cloud API.

Python

#ai-agents#ai-agents-security#ai-safety#mcp#mcp-audit#mcp-security-testing#mcp-server#model-context-protocol#security#starify

Show when Semgrep was skipped because the CLI is not installed about 1 month ago

good first issue priority:P1 status:ready component:semgrep type:enhancement

28

MCTS (Model Context Threat Scanner) is a local-first security scanner for MCP servers -- static and live tool discovery, multiple analyzers, auditable risk scores, and JSON, SARIF, and HTML output. For authors and platform teams; CI-ready, no cloud API.

Python

#ai-agents#ai-agents-security#ai-safety#mcp#mcp-audit#mcp-security-testing#mcp-server#model-context-protocol#security#starify

Fail readiness when zero MCP tools are discovered on an agent repo about 1 month ago

good first issue priority:P1 status:ready component:readiness type:enhancement

28

MCTS (Model Context Threat Scanner) is a local-first security scanner for MCP servers -- static and live tool discovery, multiple analyzers, auditable risk scores, and JSON, SARIF, and HTML output. For authors and platform teams; CI-ready, no cloud API.

Python

#ai-agents#ai-agents-security#ai-safety#mcp#mcp-audit#mcp-security-testing#mcp-server#model-context-protocol#security#starify

Support pypi:package==version syntax in mcts vet about 1 month ago

good first issue priority:P1 status:ready type:bug component:vet

28

MCTS (Model Context Threat Scanner) is a local-first security scanner for MCP servers -- static and live tool discovery, multiple analyzers, auditable risk scores, and JSON, SARIF, and HTML output. For authors and platform teams; CI-ready, no cloud API.

Python

#ai-agents#ai-agents-security#ai-safety#mcp#mcp-audit#mcp-security-testing#mcp-server#model-context-protocol#security#starify

Add --no-progress to readiness, fuzz, and scan-mcp subcommands about 1 month ago

good first issue component:fuzz priority:P1 status:ready type:bug

28

MCTS (Model Context Threat Scanner) is a local-first security scanner for MCP servers -- static and live tool discovery, multiple analyzers, auditable risk scores, and JSON, SARIF, and HTML output. For authors and platform teams; CI-ready, no cloud API.

Python

#ai-agents#ai-agents-security#ai-safety#mcp#mcp-audit#mcp-security-testing#mcp-server#model-context-protocol#security#starify

Add -o and --no-progress to scan-prompts, scan-resources, and scan-instructions about 1 month ago

good first issue priority:P1 status:ready type:bug component:discovery

28

MCTS (Model Context Threat Scanner) is a local-first security scanner for MCP servers -- static and live tool discovery, multiple analyzers, auditable risk scores, and JSON, SARIF, and HTML output. For authors and platform teams; CI-ready, no cloud API.

Python

#ai-agents#ai-agents-security#ai-safety#mcp#mcp-audit#mcp-security-testing#mcp-server#model-context-protocol#security#starify

Add -o/--output flag to mcts doctor for CI and automation about 1 month ago

good first issue priority:P1 status:ready type:bug component:doctor

28

MCTS (Model Context Threat Scanner) is a local-first security scanner for MCP servers -- static and live tool discovery, multiple analyzers, auditable risk scores, and JSON, SARIF, and HTML output. For authors and platform teams; CI-ready, no cloud API.

Python

#ai-agents#ai-agents-security#ai-safety#mcp#mcp-audit#mcp-security-testing#mcp-server#model-context-protocol#security#starify

Exclude pytest/ruff/mypy tool config from supply-chain dependency scan about 1 month ago

good first issue priority:P1 status:ready type:bug component:supply-chain

28

MCTS (Model Context Threat Scanner) is a local-first security scanner for MCP servers -- static and live tool discovery, multiple analyzers, auditable risk scores, and JSON, SARIF, and HTML output. For authors and platform teams; CI-ready, no cloud API.

Python

#ai-agents#ai-agents-security#ai-safety#mcp#mcp-audit#mcp-security-testing#mcp-server#model-context-protocol#security#starify

Return a clean error (exit 2) when snapshot cannot find a launch config about 1 month ago

good first issue priority:P0 status:ready type:bug component:snapshot

28

MCTS (Model Context Threat Scanner) is a local-first security scanner for MCP servers -- static and live tool discovery, multiple analyzers, auditable risk scores, and JSON, SARIF, and HTML output. For authors and platform teams; CI-ready, no cloud API.

Python

#ai-agents#ai-agents-security#ai-safety#mcp#mcp-audit#mcp-security-testing#mcp-server#model-context-protocol#security#starify