@finktech/mcp-verify

Name: @finktech/mcp-verify
Author: FinkTech

security MCP Server

Enterprise-grade security validation and testing tool for MCP servers. Features 60+ OWASP security rules, schema-aware fuzzing engine, real-time threat detection gateway, and multi-provider LLM analysis (Claude, GPT, Gemini, Ollama). Generate HTML/SARIF reports for CI/CD integration.

byFinkTech

VerifiedInstall Ready

securitysecurity

3 views1 stars0 forksv1.0.2AGPL-3.0

View on GitHub Homepage

Why This Matters

Discovered via github-topic:model-context-protocol and last synced 3mo ago.

VerifiedInstall Ready

Source: github-topic:model-context-protocol
Stars: 1
Last synced: 3mo ago
Install: Instructions detected

Install

1. Install the package

npx -y -p @finktech/mcp-verify mcp-verify-server

2. Add to claude_desktop_config.json

{
  "mcpServers": {
    "finktech-mcp-verify": {
      "command": "npx",
      "args": [
        "-y",
        "-p",
        "@finktech/mcp-verify",
        "mcp-verify-server"
      ]
    }
  }
}

Config file location: ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) / %APPDATA%\Claude\claude_desktop_config.json (Windows)

Tools

Resources

Prompts

Standard I/O

Transport

Available Tools (90)

100 Mutations

Score Threshold

stress

Load/concurrency testing

Code

Meaning

Profile

Use Case

SEC-050

Low

Guardrail

Protection

generateReport

Custom report generation

validate

Full security validation with 61 security rules across 6 threat categories

SEC-005

High

Emerging

</details> <details open> <summary><h3>🔌 Block MCP: MCP-Specific Security (SEC-014 to SEC-021)</h3></summary>

analyzeQuality

LLM semantic analysis

play

Interactive tool testing playground

SEC-012

High

compareServers

Baseline comparison

Format

Purpose

50 dashboard

Real-time terminal monitoring (blessed UI)

SEC-002

Critical

SEC-011

Medium

SEC-018

Medium

SEC-026

Medium

SEC-033

High

Multi-Agent

</details> <details> <summary><h3>🏢 Block C: Operational & Enterprise Compliance (SEC-042 to SEC-050)</h3></summary>

500-2000ms

AI-powered context analysis

Purpose

Input

Guide

Purpose

doctor

Diagnostics, environment checks & binary integrity verification

SEC-008

Medium

SEC-015

High

Homoglyph / Unicode Spoofing

SEC-039

Medium

SEC-046

Medium

Feature

Description

selfAudit

Validate mcp-verify itself

Command

Purpose

init

Scaffold new MCP server project

SEC-004

High

SEC-013

High

SEC-020

Medium

SEC-028

Medium

SEC-035

Medium

SEC-042

Medium

Compliance

</details> <details> <summary><h3>⚔️ Block D: AI Weaponization & Supply Chain (SEC-051 to SEC-061)</h3></summary> > **⚠️ Note**: Most rules in this block are **disabled by default** due to their adversarial nature. Enable with caution in controlled environments only.

Permanent

Third 429 within session

scanSecurity

Security-only scan

Module

Purpose

fuzz

Smart fuzzer with feedback loop & mutations

25 SEC-001

High

SEC-010

Medium

SEC-017

Medium

SEC-041

Medium

SEC-048

Medium

SEC-055

High

Type

Latency

proxy

Transparent proxy with 5 security guardrails

SEC-009

High

SEC-016

Medium

SEC-024

Critical

SEC-031

High

Medium

Missing Transaction Semantics

SEC-054

Critical

normal

G[Next Payload] F --> H[Mutation Queue\nhigh-priority first] H --> D D --> I[Vulnerability Detectors\n10 detectors · engine hints] I --> J[Findings Report\nSQL · XSS · Prompt · Timing\nPath Traversal · Jailbreak] ``` ### Intelligent Mutations When the fuzzer detects an **interesting response** (timing anomaly, crash, error pattern), it automatically generates targeted variations: ```bash # Example: SQL injection timing anomaly detected Original payload: "' OR 1=1 --" Response time: 2500ms (baseline: 120ms) Mutations generated: → "' OR SLEEP(5) --" # Timing probe (confirm blind SQLi) → "' UNION SELECT * --" # SQL depth → "\" OR 1=1 --" # Quote variation → "\u0027 OR 1=1 --" # Unicode normalization ``` ### Usage Examples ```bash # Basic fuzzing mcp-verify fuzz "node server.js" # Fuzz specific tool mcp-verify fuzz "node server.js" --tool "DatabaseQuery" # Aggressive fuzzing with fingerprinting mcp-verify fuzz "node server.js" \ --profile aggressive \ --fingerprint \ --concurrency 5 # Stop on first crash mcp-verify fuzz "node server.js" --stop-on-first ``` ### Fuzzer Output ``` Smart Fuzzer v1.0 ────────────────────────────────────────────────── Session : fuzz-1234567890-abc123 Duration : 45.23s Payloads : 250/280 Vulns : 3 (2 critical, 1 high) Errors : 0 ── Feedback Loop ────────────────────────────── Interesting responses : 12 Mutations injected : 45 Mutation rounds : 2 Timing anomalies : 5 Structural drifts : 4 Server crashes : 1 ``` 📚 **Fuzzer Architecture**: [libs/fuzzer/CLAUDE.md](./libs/fuzzer/CLAUDE.md) --- <p align="center"> <img src="docs/assets/mascot/yogui-proxy.png" width="400" alt="Yogui Proxy Guardian"> </p> ### 🛡️ Security Proxy with 3-Layer Gateway + Panic Stop The proxy command creates a **transparent MCP proxy** with **Security Gateway v1.0**: 3-layer defense system + client-aware panic stop mechanism. ### Security Gateway Architecture (3 Layers) **Real-time threat detection with progressive analysis:**

mock

Mock MCP server for testing clients

SEC-003

High

SEC-019

Medium

Strike

Backoff

validateServer

Full security validation

examples

Interactive examples browser

SEC-021

High

Developers

--- ## 🔐 Security Considerations ### What mcp-verify Protects Against ✅ **OWASP Top 10 Vulnerabilities** ✅ **JSON-RPC 2.0 and MCP Protocol Violations** ✅ **Runtime Security (via Guardrails)** - PII redaction, input sanitization, rate limiting, HTTPS enforcement ### What mcp-verify Does NOT Protect Against ❌ **Race Conditions** - Requires concurrent execution analysis ❌ **Business Logic Flaws** - Requires domain-specific knowledge ❌ **Authorization Bugs** - No access control testing ❌ **Advanced Cryptographic Issues** - Basic checks only mcp-verify is a **development tool** that helps catch vulnerabilities early. It is **not** a replacement for: - Security audits by professionals - Penetration testing - Runtime application security (RASP) - Web Application Firewalls (WAF) ### Security Warnings ⚠️ **Command Execution**: mcp-verify executes MCP servers on your machine. Only validate servers you trust or use `--sandbox` flag. ⚠️ **Network Connections**: HTTP transport connects to remote servers. Use HTTPS and validate SSL certificates for production. ⚠️ **Report Files**: Reports may contain sensitive information (API endpoints, data structures). Store securely and don't commit to public repositories. ### Reporting Security Issues Found a security vulnerability in mcp-verify itself? **Do not** open a public issue. 📧 Email: [email protected] 🔒 We'll respond within 48 hours 💰 Responsible disclosure may qualify for acknowledgment --- ## ⚠️ Usage Warnings Before using mcp-verify in production workflows, understand these critical limitations: ### 🚫 Not a Replacement for Manual Security Testing **mcp-verify is NOT a substitute for professional penetration testing.** While mcp-verify automates detection of common technical vulnerabilities (SQL injection, command injection, SSRF), it **cannot replace human expertise** in: - **Business logic vulnerabilities** - Authorization rules specific to your domain - **Complex attack chains** - Multi-step exploits requiring context - **Social engineering vectors** - Phishing, credential stuffing - **Infrastructure security** - Network misconfigurations, weak TLS settings - **Supply chain attacks** - Compromised dependencies **What mcp-verify IS**: A **first-line defense** that catches 80% of technical vulnerabilities automatically, allowing security teams to focus manual effort on complex scenarios. **What mcp-verify IS NOT**: A security certification or guarantee of safety. **Recommendation**: Use mcp-verify as part of a **defense-in-depth strategy**: ``` ┌─────────────────────────────────────────────────────────┐ │ Layer 1: mcp-verify (Automated Technical Scanning) │ ← You are here ├─────────────────────────────────────────────────────────┤ │ Layer 2: Manual Code Review (Business Logic) │ ├─────────────────────────────────────────────────────────┤ │ Layer 3: Penetration Testing (Attack Simulation) │ ├─────────────────────────────────────────────────────────┤ │ Layer 4: Runtime Protection (WAF, RASP) │ └─────────────────────────────────────────────────────────┘ ``` ### 🎓 Requires Security Knowledge to Interpret Results **You need cybersecurity expertise to distinguish real vulnerabilities from false positives.** mcp-verify generates findings with severity labels (CRITICAL, HIGH, MEDIUM, LOW), but **not all CRITICAL findings are exploitable vulnerabilities**. **Example of Misinterpretation**: ```typescript // mcp-verify finding 🔴 CRITICAL: Enum bypass - privilege escalation attempt Payload: { role: 'admin' } Response: { error: 'Unauthorized', code: 403 } // ❌ Inexperienced user: "We have a critical vulnerability!" // ✅ Security expert: "Server validated correctly - false positive" ``` **Skills Required**: - Understanding of OWASP Top 10 vulnerabilities - Ability to read JSON-RPC responses and identify error handling - Knowledge of attack vectors (SSRF, XSS, injection techniques) - Experience triaging security findings **Recommendation**: - Have a **security engineer review all CRITICAL findings** before escalating - Use mcp-verify in **CI/CD to block regressions**, not as final security approval - **Train your team** on common vulnerability patterns before deploying mcp-verify **Resources**: - [OWASP Web Security Testing Guide](https://owasp.org/www-project-web-security-testing-guide/) - [SECURITY_SCORING.md](./SECURITY_SCORING.md) - Understanding mcp-verify's scoring algorithm ### 🐳 Run in Isolated Environments (Docker Recommended) **Always execute mcp-verify in isolated environments to contain potential risks.** Despite built-in safety mechanisms (blacklist filtering, static analysis), mcp-verify executes **untrusted MCP servers** and sends **potentially malicious payloads**. Defense-in-depth requires isolation. **Risks Without Isolation**: - Malicious MCP server could access your filesystem - Compromised server could exfiltrate environment variables (API keys, credentials) - Fuzzing payloads could trigger unintended actions (if server has bugs) **Recommended Isolation Strategies**: **Option 1: Docker (Recommended for CI/CD)** ```bash # Create isolated container docker run -it --rm \ --network none \ # No network access -v $(pwd):/workspace:ro \ # Read-only filesystem node:20-alpine sh # Inside container cd /workspace npm install --production mcp-verify validate "node server.js" ``` **Option 2: Dedicated VM (Recommended for Manual Testing)** ```bash # Use throwaway cloud VM # AWS EC2, DigitalOcean Droplet, etc. # Destroy after testing ``` **Option 3: Deno Sandbox (Built-in, Limited)** ```bash # mcp-verify includes Deno sandbox (experimental) mcp-verify validate "node server.js" --sandbox # Limitations: Node.js/Deno servers only # Not supported: Python, Go, Ruby servers ``` **Minimum Isolation Requirements**: - ✅ Dedicated user account (non-root, limited permissions) - ✅ No sensitive environment variables (`AWS_SECRET_ACCESS_KEY`, etc.) - ✅ No access to production databases - ✅ Separate network segment (firewall rules) **CI/CD Example (GitHub Actions)**: ```yaml # Safe: Runs in ephemeral GitHub-hosted runner - name: Security Scan run:

fingerprint

Server technology detection

SEC-006

High

Severity

Description

Rule

Severity

SEC-030

Medium

SEC-037

High

SEC-044

Medium

SEC-051

High

ok

PII[PII Redactor] PII --> RES([✅ Client Response\n+ security metadata]) style DENY1 fill:#ff4444,color:#fff style DENY2 fill:#ff4444,color:#fff style DENY3 fill:#ff4444,color:#fff style DENY4 fill:#ff4444,color:#fff style PANIC fill:#ff4444,color:#fff style RES fill:#22aa44,color:#fff ``` > \* Layer 3 (LLM) disabled by default — enable with `--enable-llm-layer` **Use Cases:** - **Production Security** - 3-layer defense for untrusted MCP servers - **DoS Prevention** - Client-aware panic stop prevents resource exhaustion - **Compliance Auditing** - Full audit trail with explainable blocking - **Threat Intelligence** - Monitor attack patterns across clients - **Development Safety** - Prevent accidental PII leakage with redaction --- ## 🔧 MCP Server Tool (for AI Agents) mcp-verify includes a **full MCP server implementation** that exposes validation capabilities to AI agents like Claude: ### 7 Available Tools

interactive

Start interactive shell (default mode)

SEC-007

High

SEC-014

High

SEC-022

High

LLM06

</details> <details> <summary><h3>🤝 Block B: Multi-Agent & Agentic Attacks (SEC-031 to SEC-041)</h3></summary>

Low

Schema Versioning Absent

Critical

Self-Replicating MCP

pass

GW[HTTPS Enforcer\nRate Limiter\nCommand Blocker\nInput Sanitizer] GW --> UP[Upstream MCP Server] UP --> STR[429 Strike Tracker] STR -->

listInstalledServers

Enumerate MCP servers

Works Well With - Skills

verify-authenticity

真实性验证技能。分析用户提供的信息、消息、图片或内容，判断其真实性和可信度，识别虚假信息、AI生成内容或伪造内容。

220 starsHas guide

detecting-container-escape-attempts

Container escape is a critical attack technique where an adversary breaks out of container isolation to access the host system or other containers. Detection involves monitoring for escape indicators

61 starsHas guide

implementing-kubernetes-pod-security-standards

Pod Security Standards (PSS) define three levels of security policies -- Privileged, Baseline, and Restricted -- enforced by the Pod Security Admission (PSA) controller built into Kubernetes 1.25+. PS

61 starsHas guide

implementing-ebpf-security-monitoring

Implements eBPF-based security monitoring using Cilium Tetragon for real-time process execution tracking, network connection observability, file access auditing, and runtime enforcement. Covers TracingPolicy CRD authoring with kprobe/tracepoint hooks, in-kernel filtering via matchArgs/matchBinaries selectors, JSON event export, and integration with SIEM pipelines. Use when building kernel-level runtime security observability for Linux hosts or Kubernetes clusters.

61 starsHas guide

Works Well With - Agents

Agent Governance Toolkit

AI Agent Governance Toolkit — Policy enforcement, zero-trust identity, execution sandboxing, and reliability engineering for autonomous AI agents. Covers 10/10 OWASP Agentic Top 10.

6227 starscrewai

Onecli

Open-source sandboxed agent harness for teams. Giving every employee a secured personal agent.

3452 stars

Agentshield

AI agent security scanner. Detect vulnerabilities in agent configurations, MCP servers, and tool permissions. Available as CLI, GitHub Action, ECC plugin, and GitHub App integration. 🛡️

896 stars

Ironcurtain

A secure* runtime for autonomous AI agents. Policy from plain-English constitutions. (*https://ironcurtain.dev)

602 stars