correctover-scan

correctover-scan

CCS Security Scanner for MCP configurations — 14 security checks mapped to OWASP AISVS 1.0

Scan your AI Agent MCP configuration files for security issues. Detects credential exposure, SSRF vulnerabilities, missing auth, and 11 more security checks.

Quick Start

# Scan a specific config file
npx correctover-scan mcp.json

# Auto-detect and scan all MCP configs in current directory
npx correctover-scan

# Scan a directory
npx correctover-scan -d ./my-project

What It Checks

#	Check	Severity	AISVS
1	TLS Transport Encryption	Critical	C10.1
2	Server Authentication	High	C10.2
3	Timeout Configuration	Medium	C9.1
4	Credential Exposure	Critical	C5.1
5	Tool Allowlist	High	C9.3
6	Token Budget Control	High	C9.1
7	SSRF Protection	Critical	C10.3
8	Audit Logging	Medium	C12.1
9	Sandbox Isolation	Medium	C4.1
10	Dependency Version Pinning	Medium	C6.1
11	Error Handling Strategy	Medium	C12.2
12	Input Validation	High	C2.1
13	Output Validation	Medium	C7.1
14	Kill Switch	High	C9.5

Output Formats

# Terminal (default)
correctover-scan mcp.json

# JSON
correctover-scan mcp.json -f json

# SARIF (for CI integration)
correctover-scan mcp.json -f sarif > report.sarif

Supported Config Files

Auto-detects these files:

• .cursor/mcp.json
• claude_desktop_config.json
• .claude/mcp.json
• mcp.json / mcp.yaml / mcp.yml
• .vscode/mcp.json
• .mcp/mcp.json
• config/mcp.json

CI/CD Integration

GitHub Actions

- uses: Correctover/correctover-scan-action@v1
  with:
    path: ./mcp.json

Web Scanner

Try the online version: correctover.com/scan

Standards Compliance

• OWASP AISVS 1.0 — AI System Vulnerability Severity
• GB/T《智能体应用安全基本要求》 — Chinese National Mandatory Standard

Links

• correctover.com — AI Agent Runtime Assurance
• CCS Standard — Conformance Specification
• Web Scanner — Online version
• GitHub — Source code

License

MIT Correctover