Yes, licensed under Apache-2.0.

MCTS

Active·★ 30·Apache-2.0·Updated 2026-09-08

MCTS (Model Context Threat Scanner) is a local-first security scanner for MCP servers that checks permissions, injection, attack chains and risk scores. It aims to make MCP threat scanning as easy as running a linter.

#ai-agents#ai-agents-security#ai-safety#mcp#mcp-audit#mcp-security-testing#mcp-server#mcp-servers

Features

01Static and live tool discovery

0219+ analyzers with auditable risk scores

03JSON, SARIF and HTML report output

Compatibility

Cursor

IDE / Editor

Verified via docs

Windsurf

IDE / Editor

Verified via docs

VS Code

IDE / Editor

Verified via docs

Python

Runtime

Verified via docs

TypeScript

Runtime

Verified via docs

Cross-platform

Verified via docs

Quick start

$ git clone https://github.com/MCP-Audit/MCTS.git

$ cd MCTS

$ uv sync --all-extras

Use cases

↳Audit an MCP server before installing it

↳Add MCP security scanning to a CI pipeline

Alternatives

⚡Top VS:

VScall-me★24→VSgantry★72→VSGodot-MCP★301→VScomfy-skills★233→

call-me★ 24

Let your AI agents call and text your actual iPhone — Claude Code plugin + agent skill

VSCompare→

gantry★ 72

Native macOS app for managing and monitoring Docker — local and over SSH. Agent-ready: built-in MCP server and App Intents. Free and open source.

VSCompare→

Godot-MCP★ 301

Godot-MCP — Model Context Protocol (MCP) integration for the Godot Engine. AI tools for the Godot Editor in C#, with cloud connection to ai-game.dev. Apache-2.0.

VSCompare→

comfy-skills★ 233

Comfy Cloud product skills: slash commands for generating images, video, audio, and 3D with Comfy Cloud agents. Single source of truth for the installer and MCP server.

VSCompare→

ruvos★ 28

rUvOS — the agentic operating system. A single static Rust binary that runs as an MCP server, giving Claude Code persistent memory, resumable signed sessions, multi-agent orchestration, a knowledge graph, safety guardrails, and a signed audit trail. Zero Node.js, zero SQLite, zero daemon.

VSCompare→

bridge★ 34

ComplyEaze Bridge: TallyPrime MCP server for Claude Desktop, for CA firms and accountants. Reads the books on your own computer: outstandings with ageing, trial balance and vouchers. Posting Journal, Payment, Receipt and Contra vouchers is off by default; when it is on in the extension, you approve each voucher in a native dialog.

Modular, agentic framework and MCP platform you self-host. Build and run your own AI agents, connect Claude/ChatGPT/Cursor as a native MCP connector, self-host your apps, and share over encrypted P2P — on hardware you own, with local or cloud models. Open source.

VSCompare→

See all alternatives →

Comments

No comments yet. Be the first!