Scan MCP Servers for OWASP Vulnerabilities From Inside Claude. Here's How.
Every MCP server tutorial teaches you how to build.
None of them teach you how to verify it's secure before deploying.
We built Cybersecify — an MCP security scanner you can run from inside your AI assistant. Claude, Cursor, Windsurf, any MCP client. One
config line, then ask it to scan.
No CLI. No separate tool. Just talk to your AI and it scans for you.
Why this matters
MCP adoption just crossed 97 million SDK downloads. There are 13,000+ servers in the wild. Most have no authentication, no signing, no input validation. We know because we scan them.
CVE-2026-39313 (CVSS 8.7) was a single missing size check in a popular MCP framework. The config existed. The enforcement didn't.
Nobody tested it before shipping.
OWASP now has six standards covering agent and MCP security. No tool tested against them. Until now.
Setup — 30 seconds
Add to your Claude Desktop config (claude_desktop_config.json):
Restart Claude. Done.
Use it
Ask Claude:
- "Scan https://my-mcp-server.com for OWASP vulnerabilities"
- "Check if this MCP server has authentication"
- "Test this endpoint for injection vulnerabilities"
- "Run the OWASP MCP Top 10 checks against my server"
Cybersecify runs the scan and returns results inline. Pass/fail per OWASP control. Remediation guidance included.
What it checks
- OWASP MCP Top 10 (token exposure, privilege escalation, tool poisoning, injection, auth bypass, logging gaps, shadow servers)
- Input validation (SQL injection, command injection, XSS, path traversal, SSRF, prompt injection)
- Transport security (HTTPS, CORS, security headers)
- Message signing (MCPS Section 7 — nonces, timestamps, signatures)
- Tool integrity (hash pinning, definition stability)
- Replay protection
- Request body size limits (the CVE-2026-39313 check)
What you get back
Every check returns:
- OWASP control ID (MCP01-01, AISVS-10.4.11, etc.)
- Pass or fail
- What was tested
- What failed and why
- Which OWASP standard it maps to
- Remediation guidance
No grades, no scores, no dashboards. Just facts. Pass or fail against published OWASP controls.
Try it against DVMCP
Want to see what a vulnerable MCP server looks like? Scan our deliberately vulnerable server:
"Scan https://dvmcp.co.uk for OWASP MCP vulnerabilities"
It fails everything. That's the point — it's a training target. The MCP equivalent of OWASP Juice Shop.
The gap
Every developer building MCP servers today is deploying without security testing. The tools didn't exist. The standards were published but nobody built the automation to test against them.
Now you can scan from the same tool you use to build. No context switching. No separate CLI. Just ask your AI to check your work before you ship.
Cybersecify is free for basic scans. Built by CyberSecAI Ltd.