MCP02 Tool poisoning
It ships a description the model obeys
A tool description is instructions to your agent. Text hidden inside it can redirect behaviour without ever touching your code.
Know what an MCP server can do before you install it.
Aevrin runs ten open-source security scanners over a repository, a live server or a pasted config, then tells you plainly what it found and, just as plainly, what it could not check.
Free plan, no card. Five CLI scans a month.
The risk
An MCP server is code, credentials, and instructions your agent trusts.
Installing one grants real capability on your machine and in the systems it reaches. These are the failure modes Aevrin looks for.
MCP01 Token mismanagement
It runs with your credentials
Servers routinely hold tokens for the systems they reach. A leaked or over-scoped credential inherits everything you granted.
MCP05 Command injection
It executes on your machine
A stdio server is a local process. An unescaped argument reaching a shell is command execution on the host.
MCP04 Rug pull
It can change after you trust it
Tool definitions can drift after install, and dependencies carry their own known vulnerabilities.
What a scan returns
A result that admits what it could not check.
Most scanners return a number. A number from a run where half the checks failed is worse than no number at all, so every Aevrin report carries its own coverage beside the score.
Open findings per scan
github.com/example/mcp-server
5open
Latest run, worst first
Coverage, this run
- CloningCompleted
- Static analysisCompleted
- SecretsNo Docker daemon
- DependenciesNo Docker daemon
- Tool descriptionsCompleted
- AggregatingCompleted
The rule that does not bend
Incomplete is never reported as clean
4 / 6stages completed
- exit 0Clean
- exit 1Findings
- exit 2Error
- exit 3IncompleteThis run
A pipeline that treats exit 3 as a pass has to say so out loud.
Every finding carries a location
File, line, the scanner that raised it, the OWASP category it maps to, and a remediation you can act on. Not a severity badge on its own.
Scanners
10
Open-source tools run per scan, normalised into one severity scale.
OWASP MCP categories
9
Every finding is mapped to one, so a report survives a compliance thread.
Scan stages
6
Each reports its own outcome. A stage that failed is never counted as passed.
Exit codes
4
0 clean, 1 findings, 2 error, 3 incomplete. CI can tell those apart.
The platform
The whole surface your agent touches.
A server is one part of it. The agent that installed it, the credentials it inherited and the route between them are the rest.
Claude Code
Codex
14 MCP servers
6 skills
Agent posture
Scan the coding agents already on your machine. Aevrin reads what Claude Code and Codex are configured to do, and grades what that exposes.
Learn moreA Low risk
B Review
C Caution
D Do not install
MCP inventory
Every server you have connected, in one list, each graded A to D so the risky one is obvious without opening it.
Learn moreTool description
to credential
to shell
to host
Attack paths
Where a poisoned tool description, an over-scoped token and a shell-reaching argument line up into one route through your setup.
Learn moreexit 0 clean
exit 1 findings
exit 2 error
exit 3 incomplete
Hooks and CI
A pre-install hook for your agent, and an exit code your pipeline can branch on. An incomplete scan fails closed instead of passing quietly.
Learn moreOwner
Roles you define
Invite by email
Seats you buy
Shared workspaces
Invite colleagues by email, and define the roles yourself: choose exactly what each one is allowed to do. Scans, agents and findings are shared.
Learn moreVerdict
Findings
Coverage
Limitations
Exportable report
A self-contained document that prints cleanly, states a conclusion rather than only a score, and survives being read by someone who has never seen the dashboard.
Learn moreScan the next one before you install it.
Five CLI scans a month on the free plan, no card, nothing that renews on its own.