Open-Source Security Tools for MCP Servers and AI Agents
An MCP server can read files, call APIs and run commands on your behalf, so installing one is closer to installing a program than adding a plugin. A malicious or careless server can leak data or be steered by prompt injection.
The defensive tools below do four jobs: scan servers before you trust them, run them in locked-down containers, filter agent traffic through a gateway, and detect suspicious behaviour at runtime. This list covers defence only.
AgentIndex · Updated 2026-10-14
Quick picks
- mcp-scanner — scans MCP servers and tools with YARA rules, an LLM judge and Cisco's inspect API; the YARA engine needs no key.
- toolhive — runs and governs MCP servers in locked-down containers, locally or on Kubernetes.
- agentgateway — open-source proxy for LLM, MCP and A2A traffic with guardrails and observability.
- agentic_security — vulnerability scanner for LLMs and agent workflows, for red-teaming your own systems.
- ADR — research code from Uber: a telemetry sensor and dual-agent detector for securing MCP-based agents.
Side-by-side comparison
| Tool | What it is | Stars | License | Last push | Install |
|---|---|---|---|---|---|
| mcp-scanner | Apache-2.0 scanner that checks MCP servers and tools for malicious or risky behaviour with YARA rules, an LLM judge and Cisco's inspect API | 1.1k | Apache-2.0 | 2026-10-13 | uv tool install --python 3.13 cisco-ai-mcp-scanner |
| toolhive | Run and govern MCP servers in locked-down containers, locally or on Kubernetes | 2.3k | Apache-2.0 | 2026-10-13 | git clone https://github.com/stacklok/toolhive.git |
| agentgateway | Open-source proxy for LLM, MCP and A2A traffic with guardrails and observability | 5.3k | Apache-2.0 | 2026-10-13 | curl -sL https://agentgateway.dev/install.sh | bash -s -- --install-path /usr… |
| archestra | Open-source enterprise AI platform with LLM and MCP gateways | 4.4k | AGPL-3.0 (enterprise parts under a commercial license) | 2026-10-13 | docker pull archestra/platform:latest; docker run -p 9000:9000 -p 3000:3000 -… |
| agentic_security | Open-source vulnerability scanner for LLMs and agent workflows | 2.0k | Apache-2.0 | 2026-09-22 | pip install agentic_security |
| ADR | Apache-2.0 research code from Uber: a telemetry sensor and dual-agent detector for securing MCP-based AI agents | 2.0k | Apache-2.0 | 2026-10-13 | git clone https://github.com/uber/ADR |
| AiSOC | MIT self-hostable AI security operations center with a local model, auditable agent investigations and human-approved responses | 2.4k | MIT | 2026-10-12 | git clone https://github.com/beenuar/AiSOC |
| agent | Terminal DevOps agent with secret substitution and network-level guardrails | 1.8k | n/a | 2026-07-06 | curl -sSL https://stakpak.dev/install.sh | sh |
Tools in this list with an in-depth AgentIndex review: 8/8
How to choose
- Scan before you install. A scanner that reads tool descriptions, prompts and source code can catch obvious problems early.
- Isolate what you run. Container-based tools limit what a compromised server can touch.
- Add a gateway or guardrails if several agents or people share servers, so there is one place to enforce policy and log calls.
- Scanners reduce risk but do not prove safety; a clean report can still miss problems.
- Check which tools need hosted services or API keys, and where scan data is sent.
FAQ
How do I check whether an MCP server is safe?
Read its source and tool descriptions, run it with least-privilege credentials, and scan it with a tool such as MCP Scanner. Prefer maintained, well-known servers, and treat any server like a shell: it can do what its permissions allow.
What is tool poisoning or prompt injection in MCP?
It is when text in a tool description, a tool result or a document contains instructions that steer the model into doing something you did not ask for, such as leaking data. Scanners look for such patterns, and gateways and guardrails can limit the damage.
Do I need a scanner and a gateway?
They solve different problems. A scanner checks a server before you trust it; a gateway or container runtime controls what it can do while it runs. For anything beyond personal use, using both is sensible.
How we compiled this list
Tools are chosen by hand from the projects in our index, favouring those we have reviewed in depth. Stars, licence, last-push date and install command come from each repository and are refreshed with the site data. We read each project's README and docs; we have not run every tool ourselves, so test before you depend on one.