{"id":48218046,"url":"https://github.com/decoy-run/decoy-scan","last_synced_at":"2026-04-04T19:02:59.718Z","repository":{"id":346142009,"uuid":"1185640470","full_name":"decoy-run/decoy-scan","owner":"decoy-run","description":"Security scanner for MCP server configurations. Like npm audit, but for your AI agent tool servers. Finds risky tools, input validation gaps, transport vulnerabilities, and over-permissioned capability chains. Open source, zero dependencies.","archived":false,"fork":false,"pushed_at":"2026-03-22T19:27:21.000Z","size":35,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-03-23T04:02:29.635Z","etag":null,"topics":["ai-agent","cli","mcp","owasp","prompt-injection","sarif","scanner","security","supply-chain","tool-poisoning"],"latest_commit_sha":null,"homepage":"https://npmjs.com/package/decoy-scan","language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/decoy-run.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":"AGENTS.md","dco":null,"cla":null}},"created_at":"2026-03-18T19:49:15.000Z","updated_at":"2026-03-22T19:27:25.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/decoy-run/decoy-scan","commit_stats":null,"previous_names":["decoy-run/decoy-scan"],"tags_count":null,"template":false,"template_full_name":null,"purl":"pkg:github/decoy-run/decoy-scan","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/decoy-run%2Fdecoy-scan","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/decoy-run%2Fdecoy-scan/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/decoy-run%2Fdecoy-scan/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/decoy-run%2Fdecoy-scan/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/decoy-run","download_url":"https://codeload.github.com/decoy-run/decoy-scan/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/decoy-run%2Fdecoy-scan/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":31409471,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-04-04T10:20:44.708Z","status":"ssl_error","status_checked_at":"2026-04-04T10:20:06.846Z","response_time":60,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["ai-agent","cli","mcp","owasp","prompt-injection","sarif","scanner","security","supply-chain","tool-poisoning"],"created_at":"2026-04-04T19:02:35.857Z","updated_at":"2026-04-04T19:02:59.689Z","avatar_url":"https://github.com/decoy-run.png","language":"JavaScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"# decoy-scan\n\nFind security risks in your MCP servers before attackers do. Zero dependencies, zero config, zero account required.\n\n[![npm](https://img.shields.io/npm/v/decoy-scan)](https://www.npmjs.com/package/decoy-scan)\n[![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)\n\n```bash\nnpx decoy-scan\n```\n\nScans Claude Desktop, Cursor, Windsurf, VS Code, Claude Code, Zed, and Cline. Finds risky tools, detects prompt injection, analyzes toxic data flows, tracks manifest changes, and maps everything to the OWASP Agentic Top 10.\n\n## What It Checks\n\n| Check | What it finds |\n|-------|---------------|\n| Tool risk classification | Critical/high/medium/low tools by name + description |\n| Prompt injection detection | 37 patterns across 20 attack categories in tool descriptions |\n| Toxic flow analysis | Cross-server data leak (TF001) and destructive (TF002) attack chains |\n| Tool manifest hashing | Detects tool additions, removals, and description changes between scans |\n| Skill scanning | Prompt injection, hardcoded secrets, suspicious URLs in Claude Code skills |\n| Server command analysis | Pipe-to-shell, inline code, typosquatting, temp directory spawning |\n| Environment variable exposure | API keys, tokens, secrets, cloud credentials passed to servers |\n| Supply chain advisories | 40+ known vulnerable MCP packages via Decoy advisory database |\n| Transport security | HTTP without TLS, missing auth, wildcard CORS, public-bound SSE |\n| Input sanitization | Unconstrained parameters, missing maxLength, open schemas |\n| Permission scope | Over-privileged servers, dangerous capability combinations |\n| OWASP mapping | Every finding mapped to ASI01–ASI05 |\n\n## GitHub Action\n\nOne step. Scans MCP configs, enforces policy, uploads results to GitHub Security tab.\n\n```yaml\n# .github/workflows/mcp-security.yml\nname: MCP Security\non: [push, pull_request]\n\njobs:\n  scan:\n    runs-on: ubuntu-latest\n    permissions:\n      security-events: write\n    steps:\n      - uses: actions/checkout@v4\n      - uses: decoy-run/decoy-scan@v1\n```\n\nThat's it. Fails the build if critical tools or prompt injection are found. Results appear in the Security tab.\n\n### With options\n\n```yaml\n- uses: decoy-run/decoy-scan@v1\n  with:\n    policy: no-critical,no-poisoning,no-toxic-flows\n    report: true\n    token: ${{ secrets.DECOY_TOKEN }}\n```\n\n### Inputs\n\n| Input | Default | Description |\n|-------|---------|-------------|\n| `policy` | `no-critical,no-poisoning` | Comma-separated policy rules |\n| `sarif` | `true` | Upload SARIF to GitHub Security tab |\n| `report` | `false` | Upload to Decoy Guard dashboard |\n| `token` | — | Decoy API token (for `report`) |\n| `verbose` | `false` | Show all tools including low-risk |\n\n### Policy rules\n\n```\nno-critical          Fail on critical tools (code exec, file write)\nno-high              Fail on high-risk tools (file read, network)\nno-poisoning         Fail on prompt injection in tool descriptions\nno-toxic-flows       Fail on cross-server data leak / destructive chains\nno-secrets           Fail on secrets exposed in MCP config\nrequire-tripwires    Fail if decoy-tripwire not installed\nmax-critical=N       Fail if more than N critical tools\nmax-high=N           Fail if more than N high-risk tools\n```\n\n### Manual CI/CD\n\nIf you prefer raw commands over the Action:\n\n```yaml\n- run: npx decoy-scan --policy=no-critical,no-poisoning\n- run: npx decoy-scan --sarif \u003e results.sarif\n- uses: github/codeql-action/upload-sarif@v3\n  with:\n    sarif_file: results.sarif\n```\n\n## Options\n\n```bash\nnpx decoy-scan                     # Full scan with server probing\nnpx decoy-scan --json              # JSON output (stdout, pipeable to jq)\nnpx decoy-scan --sarif             # SARIF 2.1.0 for GitHub Security / VS Code\nnpx decoy-scan --skills            # Also scan Claude Code skills\nnpx decoy-scan --no-probe          # Config-only (don't spawn servers)\nnpx decoy-scan --no-advisories     # Skip advisory database check\nnpx decoy-scan --report            # Upload results to Decoy dashboard\nnpx decoy-scan --policy=RULES      # CI/CD policy gate (exit 2 on violation)\nnpx decoy-scan --verbose           # Show all tools including low-risk\nnpx decoy-scan --quiet             # Suppress status output (exit code only)\nnpx decoy-scan --no-color          # Disable colored output\n```\n\nRun from your project root to include project-level `.mcp.json` configs.\n\n## Exit Codes\n\n| Code | Meaning |\n|------|---------|\n| `0` | No critical or high-risk issues |\n| `1` | High-risk issues found |\n| `2` | Critical issues, tool poisoning, toxic flows, or policy violation |\n\n## Library\n\n```javascript\nimport {\n  scan,\n  toSarif,\n  classifyTool,\n  detectPoisoning,\n  analyzeToxicFlows,\n  hashToolManifest,\n  detectManifestChanges,\n  discoverSkills,\n  analyzeSkill,\n} from 'decoy-scan';\n\nconst results = await scan({ skills: true });\nconsole.log(results.toxicFlows);    // [{ id: \"TF001\", severity: \"critical\", roles: {...} }]\nconsole.log(results.skills);        // [{ name: \"...\", findings: [...] }]\nconsole.log(results.servers[0].manifestHash);  // \"45c4c571f03c78a2\"\n```\n\n## How It Compares\n\n| | decoy-scan | Snyk agent-scan |\n|---|---|---|\n| Language | JavaScript | Python |\n| Dependencies | **0** | 15 (aiohttp, pydantic, mcp, etc.) |\n| Install | `npx decoy-scan` | `uvx snyk-agent-scan` + Snyk account |\n| Cloud required | **No** | Yes (sends data to Snyk API) |\n| Toxic flow analysis | **Yes (local)** | Yes (cloud) |\n| Manifest change detection | **Yes** | Yes (registry-based) |\n| Skill scanning | **Yes** | Yes |\n| CI/CD policy gate | **Yes** | No |\n| SARIF output | **Yes** | No |\n| OWASP mapping | **Yes** | No |\n| Hosts supported | **8** | 6 |\n| Tripwire integration | **Yes (decoy-tripwire)** | No |\n\n## Supported Hosts\n\nClaude Desktop, Cursor, Windsurf, VS Code, Claude Code (global + project), Zed, Cline\n\n## Related\n\n- [decoy-tripwire](https://npmjs.com/package/decoy-tripwire) — Tripwire tools that detect when agents are compromised\n- [Decoy Guard](https://decoy.run) — Dashboard, threat intel, compliance reports\n- [OWASP Agentic Top 10](https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/)\n\n## License\n\nMIT\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdecoy-run%2Fdecoy-scan","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fdecoy-run%2Fdecoy-scan","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdecoy-run%2Fdecoy-scan/lists"}