mcp authscan

    0

    Static vulnerability scanner for detecting OAuth and authentication failures in MCP servers.

    $39

    Secure checkout via Stripe

    Money-back guarantee

    Converts to your local currency at checkout

    Security scanned

    Works with the AI Agents you already use

    Claude CodeClaude CodeCursorCursorCodex CLICodex CLIMuseMuseDotsDots+22 more

    mcp authscan

    Example session with this skill installed

    Scan the MCP server at ./src/auth-server for OAuth vulnerabilities and missing PKCE enforcement.

    • Read your context and instructions
    • Compiled the mcp authscan

    I have completed the static security scan of the MCP server located at ./src/auth-server. The analysis focused on OAuth 2.0 implementation standards and common authentication pitfalls.

    Security Audit Results

    Vulnerability TypeStatusSeverityFile/LocationRecommendation
    PKCE EnforcementMISSINGHighroutes/auth.ts:42Implement code_challenge and code_verifier validation.
    Redirect URI ValidationPARTIALMediumconfig/oauth.ts:12Use a strict allow-list for redirect_uri instead of wildcard matching.
    Client AuthenticationPASSLowmiddleware/client-auth.tsSecure client secrets are handled via environment variables.
    Auth Code ReplayAT RISKHighservices/token-service.tsEnsure authorization codes are invalidated immediately after one-time use.
    State ParameterPASSLowroutes/auth.ts:45Anti-CSRF state tokens are correctly generated and verified.

    Next steps

    1. Add the pkce-challenge library to your dependencies and update the authorization flow to require a challenge.
    2. Replace the regex in config/oauth.ts with an explicit array of authorized callback URLs.
    3. Implement a Redis-based TTL check to track and invalidate authorization codes after their first exchange.

    Connects securely to your tools. The creator never sees your data.

    About this skill

    Securing Model Context Protocol (MCP) servers requires more than just functional tests. This skill identifies critical OAuth and authentication vulnerabilities in your MCP server implementations before they reach production.

    What it does

    • Detects Redirect Flaws by scanning for unvalidated redirect_uri parameters that lead to open redirects.
    • Enforces PKCE by checking if Proof Key for Code Exchange is missing in mobile or single-page app flows.
    • Identifies Replay Risks by flagging potential authorization code reuse vulnerabilities.
    • Validates Client Auth by ensuring secure client authentication methods are implemented rather than relying on weak identifiers.

    How it works

    1. Target Identification where you provide the local path to the MCP server source code or directory.
    2. Static Analysis of the authentication logic and OAuth configuration within the codebase.
    3. Vulnerability Reporting which lists detected security gaps and their potential impact.

    Frameworks & tools

    This skill is designed for the Model Context Protocol (MCP) and Node.js environments. It works with standard OAuth 2.0 and OpenID Connect implementations.

    Why this beats prompting it yourself

    Generic security prompts often miss MCP-specific context or fail to trace data flow for redirect URIs accurately. This skill uses specific heuristics for auth-related static analysis that a standard LLM prompt might overlook.

    Use cases

    • Audit local MCP server implementations for common OAuth misconfigurations.
    • Check third-party MCP servers for security gaps before deployment.
    • Verify that PKCE is correctly enforced in public-facing auth flows.

    Known limitations

    This tool performs static analysis and may require manual verification of results. It is limited to Node.js implementations of MCP servers.

    How to use

    Skills on Agensi run inside your AI agent. Copy the prompt, paste it into your agent, and it connects to Agensi and installs this skill for you. If a payment is needed, your agent shows it to you first.

    Reviews

    No reviews yet

    Be one of the first to try it. Every listed skill passes our trust checks below.

    Security scanned

    Passed our 8-point scan before listing

    Fresh listing

    Recently published to Agensi

    Money-back guarantee

    Doesn't do what its page promises? You get your money back.

    Trust & safety

    Security scanned

    Verified clean 11 days ago

    • Passed all security checks, Safe to install

    Requires

    Authscan MCP

    Listed11 days ago

    What's inside

    Frequently Asked Questions