MCP Gateway (Scanner)

pramiti-mcp-gateway is a free security posture scanner for Model Context Protocol servers. Point it at a server's tools and it tells you which ones let an agent take dangerous actions — writes, irreversible operations, sensitive-data exfiltration, and arbitrary-execution power — with zero infrastructure and no changes to anything you run.

MCP gives AI agents hands. This tells you what those hands can reach.

Install

# zero dependencies — run it with no install:
uvx pramiti-mcp-gateway scan tools.json
# or
pipx run pramiti-mcp-gateway scan tools.json
# or install it:
pip install pramiti-mcp-gateway
 
# to scan live servers by connecting to them, add the 'connect' extra:
pip install 'pramiti-mcp-gateway[connect]'

Usage

scan takes a JSON manifest of MCP tools — the shape an MCP tools/list response returns — and classifies each tool's action risk:

pramiti-mcp-gateway scan tools.json          # human-readable report
pramiti-mcp-gateway scan tools.json --json   # machine-readable JSON

Example output:

MCP Security Posture
============================================================
9 tools scanned  |  read 3  write 6  unknown 0
severity:  critical 4  high 1  medium 1  low 1  info 2
------------------------------------------------------------
[CRIT] internal_db.export_patient_records
        Changes state; effects are hard to reverse; touches
        sensitive/regulated data; grants broad capability.
        signals: irreversible:export, sensitive:patient
[CRIT] payments.transfer_funds
        Changes state; effects are hard to reverse.
[HIGH] github.delete_repository
------------------------------------------------------------
Top risk: CRITICAL. These tools let an agent take high-impact
actions. Gate them before giving an agent write access.

What it classifies

Each tool is scored on four risk dimensions:

Dimension	Question
Write	Does calling it change state?
Irreversible	Can the effect be undone?
Sensitive	Does it touch regulated or personal data?
Arbitrary execution	Does it grant broad, unconstrained capability (SQL, shell, code)?

Why this exists

An MCP server can expose a delete_repository, a transfer_funds, or a run_sql tool right next to a harmless search. A prompt-injected agent can be talked into calling any of them — the danger isn't what the agent says, it's what it can do. Before you can gate agent actions, you have to see them. This scanner is the "see them" step, and it's free.

Gating them is what Praxom does.

Install

Usage

What it classifies

Why this exists

On this page