MCP Gateway (Scanner)
Free, open-source security posture scanner for MCP servers
pramiti-mcp-gateway is a free security posture scanner for
Model Context Protocol servers. Point it at a
server's tools and it tells you which ones let an agent take dangerous actions —
writes, irreversible operations, sensitive-data exfiltration, and
arbitrary-execution power — with zero infrastructure and no changes to anything
you run.
MCP gives AI agents hands. This tells you what those hands can reach.
Install
# zero dependencies — run it with no install:
uvx pramiti-mcp-gateway scan tools.json
# or
pipx run pramiti-mcp-gateway scan tools.json
# or install it:
pip install pramiti-mcp-gateway
# to scan live servers by connecting to them, add the 'connect' extra:
pip install 'pramiti-mcp-gateway[connect]'Usage
scan takes a JSON manifest of MCP tools — the shape an MCP tools/list
response returns — and classifies each tool's action risk:
pramiti-mcp-gateway scan tools.json # human-readable report
pramiti-mcp-gateway scan tools.json --json # machine-readable JSONExample output:
MCP Security Posture
============================================================
9 tools scanned | read 3 write 6 unknown 0
severity: critical 4 high 1 medium 1 low 1 info 2
------------------------------------------------------------
[CRIT] internal_db.export_patient_records
Changes state; effects are hard to reverse; touches
sensitive/regulated data; grants broad capability.
signals: irreversible:export, sensitive:patient
[CRIT] payments.transfer_funds
Changes state; effects are hard to reverse.
[HIGH] github.delete_repository
------------------------------------------------------------
Top risk: CRITICAL. These tools let an agent take high-impact
actions. Gate them before giving an agent write access.What it classifies
Each tool is scored on four risk dimensions:
| Dimension | Question |
|---|---|
| Write | Does calling it change state? |
| Irreversible | Can the effect be undone? |
| Sensitive | Does it touch regulated or personal data? |
| Arbitrary execution | Does it grant broad, unconstrained capability (SQL, shell, code)? |
Why this exists
An MCP server can expose a delete_repository, a transfer_funds, or a
run_sql tool right next to a harmless search. A prompt-injected agent can be
talked into calling any of them — the danger isn't what the agent says, it's
what it can do. Before you can gate agent actions, you have to see them. This
scanner is the "see them" step, and it's free.
Gating them is what Praxom does.