Aevrin MCP Scanner

Aevrin

Security review for MCP servers, with honest coverage and actionable fixes.

Review source repositories, live MCP servers, or pasted configuration through the same authenticated product workspace your team will use to triage, verify, and repeat scans. No invented trend lines. No fake confidence.

Open the product Install the CLI

Coverage is explicit

Complete, partial, failed, skipped, and stale states are called out instead of hidden.

Findings stay operational

Evidence, remediation, OWASP MCP mapping, and repeat-scan verification live in one flow.

Built for real rollout

Use the dashboard, CLI, and Claude Code hook together without drifting into separate products.

Authenticated workflow preview

Review the available evidence before a server gets installed.

Security-first workspace

New scan

Start from the target you actually have

Source repository, live MCP server, or pasted config input. Aevrin explains the trade-off in coverage before you launch the scan.

Source repo: broadest code, dependency, and secret coverage
Live MCP server: runtime install decision, reduced static visibility
Pasted config: fastest route for triage and follow-up

Result state

Partial scans stay partial

Coverage notes, skipped stages, and failed scanners remain visible on the result page so remediation decisions stay grounded.

StatusPartial coverage

Stage summaryCompleted, skipped, and failed stages

Next actionReview limitations before approving install

Finding detail

Fixes are not just labels

A finding page explains where the issue lives, why it matters, how to fix it, and how to verify the fix with a repeat scan.

EvidenceFile, line, manifest field, or tool surface

RiskOWASP MCP category and source scanner

VerificationRepeat the comparable scan after remediation

Rollout path

One product across browser, terminal, and hook

Install the CLI, log in with device flow, and use the Claude Code hook only where automated pre-install checks fit your process.

aevrin login aevrin scan github.com/owner/mcp-server --upload

API keys stay reserved for CI and other non-interactive environments.

Why teams adopt it

The product is designed around decision quality, not empty dashboard filler.

Real scanner evidence

Aevrin normalizes findings from the actual open-source tools in the scan pipeline. The CLI, API, and dashboard read the same vocabulary.

Honest completeness

Partial and failed stages are surfaced directly so a clean findings list never hides missing coverage, broken tooling, or network limits.

Actionable remediation

Each finding is framed around what happened, why it matters, how to fix it, and how to verify the fix with a repeat scan.

Developer workflow coverage

Use the dashboard for guided scans, the CLI for local review, and the Claude Code hook for pre-install decisions.

What users need answered

The product is organized around the questions security reviews actually produce.

What needs my attention right now?

What was scanned, how completely, and when?

Why is this finding dangerous?

How do I fix it?

How do I verify the fix actually worked?

Start with a dashboard scan

Review target type, coverage, stage failures, and remediation without installing anything locally first.

Open authenticated workspace

Move to CLI for repeated checks

Run the same scanner vocabulary from your own terminal when you want fast local confirmation before merge or install.

Add the hook for gatekeeping

Use the Claude Code pre-install check when you want unsafe MCP adds to warn or block before they touch a workstation.

Pricing

Simple per-scan-type limits

No surprise overages, ever.

MonthlyAnnual

Free

$0/month

5 CLI scans / month
2 hook auto-scans / month
5 dashboard scans / month
7-day scan history

Hobby

Individual plan

$15/month

$180 billed today for one year — save $48

50 CLI scans / month
20 hook auto-scans / month
50 dashboard scans / month
90-day scan history
OWASP MCP-mapped report export

Team

$59/month

$708 billed today for one year — save $240

Unlimited CLI scans
Unlimited hook auto-scans
Unlimited dashboard scans
Unlimited scan history
OWASP MCP-mapped report export
Single-account workspace
Team seats and shared roles are not yet included

Feature	Free	Hobby	Team
CLI scans	5 / month	50 / month	Unlimited
Hook auto-scans	2 / month	20 / month	Unlimited
Dashboard scans	5 / month	50 / month	Unlimited
Scan history retained	7 days	90 days	Unlimited
Accounts	1	1	1 account
OWASP MCP-mapped report export	—

Frequently asked questions

Prices are charged in US dollars through Razorpay. Taxes may apply. Aevrin pauses new scans at the configured limit and does not create automatic overage charges.

Install and verify

Set up Aevrin from a real terminal, not a marketing checklist.

Use the exact commands the current product supports. Device login is the default path for developers. API keys are for CI and other non-interactive automation.

macOS install

brew install pipx
pipx ensurepath
pipx install aevrin

Verify and sign in

aevrin --version
aevrin login

AI agent install prompt

Paste this into Claude Code or another agent when you want it to install the CLI for you.

Set up the Aevrin CLI on this machine and verify the installation end to end.

1. Detect the operating system and shell. Do not use sudo and do not modify the system Python.
2. Choose exactly one installation path. If Node.js 18+ and npm are already available, run: npm install --global aevrin. Otherwise use pipx and install it with the matching command:
   - macOS: brew install pipx && pipx ensurepath
   - Linux: python3 -m pip install --user pipx && python3 -m pipx ensurepath
   - Windows PowerShell: py -m pip install --user pipx; py -m pipx ensurepath
3. For pipx, install or upgrade Aevrin with: pipx install aevrin (use pipx upgrade aevrin if already installed). For npm, use: npm install --global aevrin@latest. Do not install both variants in the same run.
4. Run: aevrin --version
5. Run: aevrin login
6. Pause while I approve the browser device-login page. Never ask me to paste a password, API key, or browser token into the terminal.
7. After approval, show me how to run a local check with: aevrin scan . --no-upload --fail-on high

Report every command you executed and its result. If a command fails, stop at that command, preserve the full non-secret error, and explain the smallest corrective action.

AI agent hook prompt

Paste this into Claude Code when you want the MCP pre-install hook configured in a project.

Configure Aevrin's Claude Code PreToolUse security hook for this project without overwriting existing settings.

1. Verify the CLI first with: aevrin --version
2. Run: aevrin hook setup
3. Pause while I approve the browser device-login page. Never request or print the resulting credential.
4. Copy the exact PreToolUse JSON printed by Aevrin.
5. Open this project's .claude/settings.json. If it exists, preserve every existing key and hook; merge the new Bash and Write matcher entries instead of replacing the file. If it does not exist, create it.
6. Validate that the finished file is valid JSON.
7. Confirm that Bash commands using claude mcp add and full writes to .mcp.json or claude_desktop_config.json are covered. Do not claim partial Edit operations are covered.
8. Show me the final non-secret hook configuration and the file path changed.

Stop if setup fails, JSON cannot be merged safely, or an existing matcher conflicts. Do not invent paths or credentials and do not run an MCP server as part of setup.