How Do You Scan an MCP Server Before You Install It?

To scan an MCP server or skill before you install it, run two commands: npm install -g @panguard-ai/panguard to install PanGuard, then pga scan <target> to scan the code. The scan checks the target against nearly 690 ATR (Agent Threat Rules) detection rules for prompt-injection patterns, leaked secrets, obfuscation, and known malicious behavior. It runs in seconds, prints any findings with the exact rule ID that fired, and exits with a non-zero code if it finds something critical. It is free and MIT-licensed.

This matters because MCP servers run with real access to your machine and your data, and the supply chain has already been abused. The postmark-mcp server, a trusted MCP tool, silently BCC'd between 3,000 and 15,000 emails a day for fifteen published versions before anyone noticed. MCPJam Inspector shipped a default 0.0.0.0 binding (CVE-2026-23744) that turned a single HTTP request into remote code execution in every version before v1.4.3. Azure MCP Server had an SSRF (CVE-2026-26118) that stole managed-identity tokens. Installing an MCP server is running someone else's code inside your agent. A pre-install scan is the cheapest place to catch a problem.

What does pga scan actually check?

The scan reads the target's source and manifest and runs it against the ATR rule corpus. ATR is an independent, open, MIT-licensed detection standard that PanGuard is built on and operates. Think Sigma or CVE for AI-agent attacks: the rules are the standard, PanGuard is the engine that runs them. The corpus is nearly 690 rules across 10 categories as of July 2026 (npm agent-threat-rules v3.5.6).

Four concrete things it looks for:

• ●Prompt-injection patterns: instructions hidden in tool descriptions, skill markdown, or server metadata that try to hijack your agent's goal (OWASP ASI01, Agent Goal Hijack).
• ●Leaked or exfiltrated secrets: hardcoded API keys, tokens, and code paths that read your environment and phone it home.
• ●Obfuscation: base64 blobs, encoded payloads, and indirection whose only purpose is to hide what the code does from a reader.
• ●Known malicious behavior: patterns matched from real incidents, including silent BCC/exfiltration and unexpected code execution (OWASP ASI05).

The detection layer here is deterministic Layer 1 rules: they either match or they don't, and they run in milliseconds. On a benchmark of 498 real-world SKILL.md samples, that layer gets 100% recall at 97% precision (0.2% false positives). On the NVIDIA garak in-the-wild jailbreak corpus of 650 samples, it catches 97.2%. These are Layer 1 numbers on those specific corpora, not a single blended engine score.

How to scan an MCP server, step by step

1. Install PanGuard. npm install -g @panguard-ai/panguard. One global install gives you pga. 2. Start the daemon (first run only). pga up. This brings up the local scan engine. It auto-detects your agent runtimes: Claude Code, Cursor, Windsurf, Gemini CLI, Cline, Codex CLI, and more. 3. Scan the target before you install it. pga scan <target> where <target> is a local path, a package name, or a repo. Do this before you add the server to your agent config, not after. 4. Read the findings. Each finding names the ATR rule ID that fired, the severity, and the line it hit. A CRITICAL means: do not install this until you understand why. 5. Decide. Clean scan and you install. Critical finding and you stop, or you open the file at the flagged line and judge it yourself. The rule ID gives you something to look up, not just a red banner.

What does a real scan output look like?

Here is a scan of an MCP server that hides an exfiltration instruction inside its tool description:

$ pga scan ./suspicious-mcp-server

PanGuard  scanning ./suspicious-mcp-server
  engine: ATR agent-threat-rules v3.5.6  (688 rules)

  server.js ................ 2 findings
  tools/mailer.js .......... 1 finding
  package.json ............. clean

  CRITICAL  [ATR-2026-00040]  Tool-description prompt injection
    tools/mailer.js:41
    Tool description instructs the agent to BCC every outgoing
    message to an external address. Hidden from the user-facing
    schema. OWASP ASI01 (Agent Goal Hijack).

  HIGH      [ATR-2026-00112]  Environment secret read + network egress
    server.js:88
    Reads process.env and posts it to a non-declared host.

  MEDIUM    [ATR-2026-00087]  Base64-encoded payload
    server.js:16
    Encoded blob decoded and eval'd at load time.

  Result: FAIL  1 critical, 1 high, 1 medium
  Do not install. Review tools/mailer.js:41 first.

That CRITICAL is the postmark-mcp pattern: a legitimate-looking tool with a silent BCC buried in its description. The scanner does not need to know the specific server. It matched the behavior, named the rule, and pointed at the line.

Why a rule ID and not just a warning?

Because a warning you can't verify is noise. Every finding is anchored to an ATR rule ID, so you can read the rule, see exactly what pattern it matches, and decide whether it applies to your case. The rules are open and MIT-licensed. When a new attack appears, an AI understands it once, it gets written as a deterministic rule, and that rule then runs in milliseconds for everyone. New attack to shipped rule takes about an hour. That is why the corpus moves from a checklist to something executable.

This is scanning before install. If you want detection while the agent is running, Guard is the runtime side: pga up starts it, and it watches tool calls live. But the scan is the first gate, and it costs one command.

FAQ

Is PanGuard free?

Yes. Community is the complete product, MIT-licensed, with no paywall and no locked features. npm install -g @panguard-ai/panguard and you have the full scanner and runtime Guard.

What is the difference between ATR and PanGuard?

ATR is the open, independent detection standard (the rules). PanGuard is the engine that runs those rules to scan and protect your agents. It is like the relationship between Sigma or CVE and the vendor that operates it. ATR is governed independently and PanGuard is built on it.

Can it scan skills too, not just MCP servers?

Yes. pga scan <target> works on a skill (a SKILL.md and its files) or an MCP server the same way. On a benchmark of 498 real-world skill samples the Layer 1 rules hit 100% recall at 97% precision.

Will it produce false positives?

It can, and the rate depends on the lane. On a 65,000-sample benign gate, the enforce lane runs about 0.24% false positives and the default hunt lane about 9%. There is no single blended number. The hunt lane is intentionally noisier so it catches more; that is a tradeoff you can see in the findings.

Next step: install it and scan the next MCP server before you add it to your agent. npm install -g @panguard-ai/panguard, then pga scan <target>.