🚨 Critical MCP Vulnerabilities Disclosed — April 2026

Scan MCP Servers
Before You Connect

4 critical CVEs disclosed. 150M+ downloads affected. 1,500+ servers at risk. Audit any MCP server for vulnerabilities in seconds — before it accesses your data.

4
Active CVEs
150M+
Downloads Affected
1,500+
Servers at Risk
<30s
Time to Scan

Try the Scanner

Enter an MCP server package name or URL. Try "@anthropic/mcp-server-filesystem" or "unknown/mcp-server-suspicious"

🔍

Active MCP Vulnerabilities

Critical security flaws discovered in the MCP ecosystem. These are not theoretical — they're being exploited now.

CVE-2025-65720CRITICAL

Systemic RCE in MCP Transport

Unauthenticated remote code execution via STDIO misconfiguration. Affects Anthropic SDKs, LiteLLM, LangChain.

CVE-2025-54073CRITICAL

Command Injection in mcp-package-docs

Unsanitized child_process.exec allows arbitrary system commands under server privileges.

CVE-2025-53818CRITICAL

GitHub Kanban MCP RCE

Command injection attacks in MCP operations on affected v0.3.0 servers.

CVE-2025-6514CRITICAL

mcp-remote OAuth RCE (CVSS 9.6)

Client-side RCE via malicious authorization_endpoint in mcp-remote v0.0.5-0.1.15.

Scan + Runtime Protection

Other tools only scan before deployment. MCPGuard watches your live connections too.

🔍

CVE Database Scan

Real-time check against all known MCP CVEs and security advisories.

🔐

OAuth/Token Audit

Detect consent bypass, static client IDs, and redirect URI vulnerabilities.

💉

Injection Detection

Find command injection and prompt injection vectors before they reach your AI.

📦

Supply Chain Analysis

Audit npm packages, maintainer history, dependency trees, and update cadence.

📡

Runtime Monitoring

Watch live MCP connections for suspicious API calls, token misuse, and privilege escalation.

🔔

Instant Alerts

Get notified when a connected server starts behaving differently than its scan report.

How It Works

From scan to safe connection in under 30 seconds.

🔍
Step 1

Scan

Enter the MCP server package name or URL. We check it against our vulnerability database.

📊
Step 2

Review Report

Get a detailed security report with risk score, CVE matches, and severity breakdown.

Step 3

Connect Safely

Only connect servers that pass. Runtime monitoring keeps watching after deployment.

Pricing

Start free. Upgrade when you need more.

Free

$0forever
  • 3 scans per day
  • Basic security reports
  • CVE database check
  • Email support
POPULAR

Pro

$9/mo
  • Unlimited scans
  • Detailed vulnerability reports
  • API access
  • OAuth audit
  • Supply chain analysis
  • Priority support

Team

$49/mo
  • Everything in Pro
  • CI/CD integration
  • Team dashboard
  • Runtime monitoring
  • Instant alerts
  • Custom policies

Don't Connect Blind

Every MCP server you add is a potential attack vector. Scan first. Connect second. Monitor always.

Start Scanning FreeLearn More