18 Targets. Zero CRITICAL.

MCP servers are the fastest-growing vector for AI agent compromise. A single malicious tool — disguised as a legitimate MCP server — gains full read/write access to filesystems, network calls, and shell execution. No standard scanner exists. Until now.

One command against any MCP server directory. MCTS runs static inspection, runtime fuzzing, and behavioral evaluation across 12 security categories — and produces a SARIF report ready for CI enforcement.

$ pip install mcts
$ mcts scan .

Scanning 14 MCP servers...
  CRITICAL  tool-poison: server.py:42
         tool "create_file" executes shell command
         without input sanitization
  HIGH      injection: tools.json:18
         description contains prompt override
  MEDIUM    credential: auth.py:73
         reads API key from unvalidated env var

9 findings (1 critical, 3 high, 3 medium, 2 low)
Scan complete in 0.4s. Report: scan-report.sarif

# .github/workflows/mcts.yml
name: MCTS Security Scan
on: [pull_request]
jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: MCTS Scan
        uses: tcconnally/mcts-action@v1
        with:
          fail-on: high
# Blocks merge on HIGH+ findings

Analyzers organized into 12 categories. Every finding maps to a specific category with a confidence score and triage tags — no black-box "risk rating" that can't be traced back to the rule that fired.

12 categories × 10 analyzers avg = 120 rules

MCTS tests its own detections. Every analyzer has a matching regression test that verifies: does this rule catch what it claims to catch? This is the one feature no competitor has — and it means our severity scores aren't guesses.

We scanned 18 of the most popular MCP servers. Zero CRITICAL exploitable vulnerabilities found. Every HIGH finding is an informational heuristic — not an exploit. Triage tags on every finding for fast human review.

18 servers scanned Jun 12, 2026. Zero CRITICAL across all targets. HIGH findings are informational heuristics, supply chain alerts, or framework infrastructure noise — nothing exploitable. Scan command: mcts scan <repo>