Ramparts: mcp (model context protocol) scanner
A fast, lightweight security scanner for Model Context Protocol (MCP) servers with built-in vulnerability detection.
Overview
Ramparts is a scanner designed for the Model Context Protocol (MCP) ecosystem. As AI agents and LLMs increasingly rely on external tools and resources through MCP servers, ensuring the security of these connections has become critical.
The Model Context Protocol (MCP) is an open standard that enables AI assistants to securely connect to external data sources and tools. It allows AI agents to access databases, file systems, and APIs through toolcalling to retrieve real-time information and interact with external or internal services.
Ramparts is under active development.
The Security Challenge
MCP servers can expose powerful capabilities to AI agents, including:
- File system access (read/write files, directory traversal)
- Database operations (SQL queries, data manipulation)
- API integrations (external/internal/local service calls, authentication)
- System commands (process execution, system administration)
Without proper security analysis, these capabilities can become attack vectors for:
- Tool Poisoning - bypassing AI safety measures
- MCP Rug Pulls - unauthorized changes to MCP tool descriptions after initial user approval.
- Data exfiltration - leaking sensitive information
- Privilege escalation - gaining unauthorized access
- Path traversal attacks - accessing files outside intended directories
- Command injection - executing unauthorized system commands
- SQL injection - manipulating database queries
What Ramparts Does
Ramparts provides security scanning of MCP servers by:
- Discovering Capabilities: Scans all MCP endpoints to identify available tools, resources, and prompts
- Static Analysis: Performs rule-based checks for common vulnerabilities
- LLM-Powered Analysis: Uses AI models to detect sophisticated security issues
- Risk Assessment: Categorizes findings by severity and provides actionable recommendations
Who Ramparts is For
Ramparts is designed for developers using local, remote MCP servers or building their own MCP servers and interested in scanning it for any vulnerabilities it may expose. Developers may use Ramparts locally to scan the MCP servers they use in their local development environment (e.g., Cursor, Windsurf, Claude Code etc.,).
If you're using MCP servers - whether they're running locally on your machine or hosted remotely - Ramparts helps you understand what security risks they might pose. You can scan third-party MCP servers before connecting to them, or validate your own local MCP servers before deploying them to production.
If you're building MCP servers - whether you're creating tools, resources, or prompts - Ramparts gives you confidence that your implementation doesn't expose vulnerabilities to AI agents. It's especially useful for developers who want to ensure their MCP tools are secure by design.
Why Rust?
The Ramparts mcp scanner is implemented in Rust to prioritize performance, reliability, and broad portability. Rust offers native execution speed with minimal memory overhead, making it well-suited for analyzing large prompt contexts, tool manifests, or server topologies—without the need for a heavyweight runtime. Ramparts was built with a view of operating in CI pipelines, agent sandboxes, or constrained edge environments which made the ability to compile to a single, compact binary essential.
Key Features
Coverage: Analyzes all MCP endpoints (server/info, tools/list, resources/list, prompts/list) and evaluates each tool, resource, and prompt
Detection: Detects path traversal, command injection, SQL injection, prompt injection, secret leakage, auth bypass, and more—using both static checks and LLM-assisted analysis
Performance: Built in Rust for fast, efficient scanning of large MCP servers
Output: Choose from tree-style text, JSON, or raw formats for easy integration with scripts and dashboards
Modular & Extensible: Add custom rules or tweak severity thresholds via a simple configuration file
Use Cases
- Security Audits: Comprehensive assessment of MCP server security posture
- Development: Testing MCP servers during development and testing phases
- Compliance: Meeting security requirements for AI agent deployments
Quick Start
Installation
From crates.io (Recommended)
From source
Basic Usage
Scan an MCP server
Scan with custom output format
Scan with verbose output
Example Output
================================================================================
MCP Server Scan Result
================================================================================
URL: https://api.githubcopilot.com/mcp/
Status: Success
Response Time: 1234ms
Timestamp: 2024-01-01T12:00:00.000Z
Server Information:
Name: GitHub Copilot MCP Server
Version: 1.0.0
Description: GitHub Copilot MCP server for code assistance
Capabilities: tools, resources, prompts
Tools: 74
Resources: 0
Prompts: 0
Security Assessment Results
================================================================================
🌐 GitHub Copilot MCP Server
✅ All tools passed security checks
└── push_files passed
└── create_or_update_file warning
📋 Analysis: Standard GitHub file creation/update functionality
├── HIGH: Tool allowing directory traversal attacks: Potential Path Traversal Vulnerability
│ Details: The tool accepts a 'path' parameter without proper validation, allowing potential path traversal attacks.
└── delete_file warning
📋 Analysis: Standard GitHub file deletion functionality
├── HIGH: Tool allowing directory traversal attacks: Potential Path Traversal Vulnerability
│ Details: The tool allows the deletion of a file from a GitHub repository and accepts parameters like branch, message, owner, path, and repo. If path validation is not implemented properly, an attacker could manipulate the path to access files outside the intended directory.
Summary:
• Tools scanned: 74
• Warnings found: 2 tools with 2 total warnings
================================================================================
Examples
Scan Different MCP Servers
GitHub Copilot
Local MCP server
Custom MCP server with API key
With custom timeout
Advanced Scanning Options
Scan with custom severity threshold
Scan with specific output format
Scan with custom configuration
Advanced Usage
Server Mode
Start Ramparts as a server for continuous monitoring:
Batch Scanning
Scan multiple servers from a file:
# Create a servers list
# Run batch scan
Scan from IDE Configuration
Scan MCP servers configured in your IDE:
CLI Reference
Basic Commands
# Scan an MCP server
# Start Ramparts server mode
# Scan from IDE configuration
# Initialize configuration file
# Show help
Scan Options
)
)
Server Options
Configuration
Ramparts uses a ramparts.yaml configuration file for customizing security rules and thresholds:
Initialize Configuration
Create a custom configuration file:
This creates a ramparts.yaml file:
# Example ramparts.yaml
security:
# LLM analysis settings
llm_batch_size: 10
llm_timeout: 30
# Severity thresholds
min_severity: "MEDIUM"
# Custom security rules
custom_rules:
- name: "custom_path_check"
pattern: "path.*\\.\\./"
severity: "HIGH"
description: "Custom path traversal detection"
# Vulnerability detection settings
vulnerability_detection:
enable_path_traversal: true
enable_command_injection: true
enable_sql_injection: true
enable_prompt_injection: true
enable_secret_leakage: true
enable_auth_bypass: true
# Output settings
output:
format: "text" # text, json, raw
pretty_print: false
include_details: true
include_recommendations: true
# Performance settings
performance:
max_concurrent_requests: 10
request_timeout: 30
retry_attempts: 3
Output Formats
Text Format (Default)
JSON Format
Raw Format
Troubleshooting
Common Issues
Connection Timeout
# Increase timeout
Authentication Errors
# Check your auth headers format
Permission Denied
# Check file permissions
Configuration File Not Found
# Initialize configuration
Contributing
We welcome contributions to Ramparts mcp scan. If you have suggestions, bug reports, or feature requests, please open an issue on our GitHub repository.
Support
- Issues: GitHub Issues