Quick Install

Copy the config for your editor. Some servers may need additional setup — check the README.

Add to claude_desktop_config.json:

{
  "mcpServers": {
    "mcp-witness": {
      "command": "uvx",
      "args": [
        "mcp-witness"
      ]
    }
  }
}

Or install with pip: pip install mcp-witness

README Excerpt

> Security scanner for Model Context Protocol servers and AI agents. **Demonstrated on EC2 with live AWS IAM credentials retrieved.** Static rule MCP-S-009 flagged the missing scheme/host validation on `mcp-server-fetch`'s `fetch` tool; the dynamic harness (MCP-D-003) drove the live probe against an EC2 `t3.micro` with IMDSv2 set to Optional and got back a real `AccessKeyId` / `SecretAccessKey` / `Token` triplet for the attached IAM role. Coordinated disclosure filed as [modelcontextprotocol/ser

Topics

agentic-aiai-agentsdns-rebindingllm-securitymcpmodel-context-protocolscannersecurityssrfstatic-analysissupply-chain-securityvulnerability-disclosure

mcp-witness

Quick Install

README Excerpt

Topics

Related Security Servers