Metadata-Version: 2.4
Name: correctover-mcp-scanner
Version: 3.0.2
Summary: Correctover MCS v3.0 — MCP Server Security Boundary Scanner. Automated vulnerability audit for the Model Context Protocol ecosystem.
Author-email: Guigui Wang <wangguigui@correctover.com>
License-Expression: Elastic-2.0
Project-URL: Homepage, https://correctover.com
Project-URL: Repository, https://github.com/Correctover/ccs-mcp-scanner
Project-URL: Specification, https://correctover.com/ccs-protocol
Keywords: correctover,ccs,mcp,security,scanner,audit,vulnerability
Classifier: Development Status :: 3 - Alpha
Classifier: Intended Audience :: Developers
Classifier: Topic :: Security
Classifier: Programming Language :: Python :: 3.12
Requires-Python: >=3.10
Description-Content-Type: text/markdown
License-File: LICENSE
Requires-Dist: mcp>=1.0.0
Requires-Dist: httpx>=0.27.0
Requires-Dist: click>=8.1.0
Requires-Dist: pydantic>=2.0.0
Requires-Dist: jinja2>=3.1.0
Requires-Dist: rich>=13.0.0
Dynamic: license-file

# Correctover-MCS v3.0.0
---

### 🇨🇳 国内用户 · 支付宝一键购买

本工具的合规授权与批量能力可通过支付宝 SkillPay 获取：

- 打开货架：https://skillpay.alipay.com/public/correctover
- 或把这行发给你的 AI 助手：**请通过 SkillPay 购买并安装 Skill「CCS收据批量审计」**

---


**MCP Server Security Boundary Scanner — Automated vulnerability audit for the Model Context Protocol ecosystem**

[![Version](https://img.shields.io/badge/version-3.0.0-blue.svg)]()
[![Python](https://img.shields.io/badge/python-3.10+-blue.svg)]()
[![License](https://img.shields.io/badge/license-Elastic--2.0-blue.svg)]()

---

## What is MCS?

Correctover-MCS (MCP Scanner) is an automated security scanner that audits MCP (Model Context Protocol) servers for vulnerabilities. It identifies security boundary violations, injection points, privilege escalation paths, and data exfiltration risks in MCP server implementations.

Built on CCS verification principles — every finding is backed by code-level evidence and reproducible PoC.

### Core Capabilities

- **Automated Audit**: Scan any MCP server implementation for known vulnerability patterns
- **Signature Engine**: 50+ vulnerability signatures across SSRF, RCE, auth bypass, data exposure
- **Code Analysis**: Static analysis + dynamic testing with containerized sandboxes
- **CVSS Scoring**: Automated severity classification with CVSS v3.1 scoring
- **Report Generation**: Professional audit reports with PoC, impact analysis, and remediation

---

## Quick Start

```bash
pip install correctover-mcs
```

### Scan a target

```bash
# Scan a GitHub repository
ccs-scan scan --repo https://github.com/example/mcp-server

# Scan a PyPI package
ccs-scan scan --pypi mcp-server-example

# Scan with custom signatures
ccs-scan scan --repo https://github.com/example/mcp-server --signatures custom-sigs/

# Generate full report
ccs-scan scan --repo https://github.com/example/mcp-server --report full --format pdf
```

### API Usage

```python
from ccs_scanner import MCPServerScanner

scanner = MCPServerScanner()
results = scanner.scan_repo("https://github.com/example/mcp-server")

for vuln in results.vulnerabilities:
    print(f"[{vuln.cvss}] {vuln.title}")
    print(f"  File: {vuln.file_path}:{vuln.line}")
    print(f"  PoC: {vuln.poc_code}")
```

---

## Vulnerability Categories

| Category | Signature Count | Max CVSS | Examples |
|----------|----------------|----------|----------|
| SSRF | 12 | 9.3 | URL parameter injection, proxy abuse |
| RCE | 8 | 9.8 | Container escape, command injection |
| Auth Bypass | 10 | 9.1 | Token timing attack, missing auth |
| Data Exposure | 7 | 8.8 | Sensitive path access, no ACL |
| Supply Chain | 6 | 8.6 | Unsigned images, dependency confusion |
| DoS | 5 | 7.5 | Resource exhaustion, infinite loops |

---

## Architecture

```
┌─────────────────────────────────────────┐
│              MCS Scanner v3.0.0         │
│  ┌──────────┬──────────┬──────────────┐ │
│  │  Target   │ Signature│    Code     │ │
│  │ Fetcher   │  Engine  │  Analyzer   │ │
│  ──────────┴──────────┴──────────────┘ │
│  ┌──────────┬──────────┬──────────────┐ │
│  │ Sandbox   │   CVSS   │   Report    │ │
│  │ Executor  │ Scorer   │ Generator   │ │
│  └──────────┴──────────┴──────────────┘ │
└─────────────────────────────────────────┘
```

---

## Performance

| Metric | Value |
|--------|-------|
| Scan time (avg repo) | 45-120s |
| Signatures loaded | 50+ |
| False positive rate | <5% |
| True positive rate | >90% (verified) |

---

## Deployment

### Local

```bash
pip install correctover-mcs
ccs-scan scan --repo <target>
```

### Docker

```dockerfile
FROM python:3.12-slim
RUN pip install correctover-mcs
ENTRYPOINT ["ccs-scan"]
```

```bash
docker build -t correctover-mcs .
docker run correctover-mcs scan --repo <target>
```

---

## License

Elastic License 2.0 — © 2026 Correctover. See [LICENSE](https://www.elastic.co/licensing/elastic-license).

## Contact

- **Website**: [correctover.com](https://correctover.com)
- **Email**: wangguigui@correctover.com
- **GitHub**: [github.com/Correctover](https://github.com/Correctover)
