AI Security
MCP security tools that inventory the agent before it talks (2026)
A 2026 shortlist of inspectors, scanners, and gates for MCP servers you already run. Public docs, not a poisoning cookbook.
Expertise: AI Security · Level: Intermediate · 12 min read
A tool description is still untrusted input.
The model called a local server and nobody listed what that server can delete. MCP security is inventory, inspect, and an allowlist. Link LLM security for output handling. This page will not teach a jailbreak.
Six shelves. One official inspector. One agent scanner. One vendor catalog. One isolator. One gateway. One stdio bridge. Public docs. Not a bake-off.
Technical check: we cross-check first-party product pages, public licenses, and live documentation. Rank is a technical recommendation, not a recap of other lists, and not a lab bake-off.
| Tool | Best for | License |
|---|---|---|
| MCP Inspector | Official look at a server you already run | MIT |
| Snyk Agent Scan | Scan MCP configs on a machine you own | Apache-2.0 |
| Docker MCP Toolkit | A catalog you can pin instead of a random npx | Docker terms |
| ToolHive | Run MCP servers in a box you isolate | Apache-2.0 |
| ContextForge MCP Gateway | A gateway in front of servers you already trust | Apache-2.0 |
| mcp-proxy | stdio to HTTP on a host you own | MIT |
MCP Inspector
Best for official look at a server you already run
The official inspector talks to an MCP server and shows tools, prompts, and resources. You point it at a server you operate.
Key features
- List tools and prompts
- Official repo
- MIT
- You bring the server
Why we like it
This is the hidden gem. See the surface before you wire it to a model.
Limits
It is a look, not a policy engine. Do not point it at a stranger’s host.
Snyk Agent Scan
Best for scan MCP configs on a machine you own
Formerly Invariant mcp-scan. Discovers agent configs and MCP servers on a machine you own. Scanning a config can start the servers listed in it. Read that warning.
Key features
- Discover local MCP configs
- Risk notes they document
- inspect without analysis
- Snyk Evo optional
Why we like it
A laptop inventory is the honest first CIEM of agents. Name the rename so old bookmarks still work.
Limits
Starting listed servers is a consent problem. Use only on machines you operate. No jailbreak recipes here.
Docker MCP Toolkit
Best for a catalog you can pin instead of a random npx
Docker documents an MCP catalog and toolkit in Docker Desktop. The pitch is signed, listed servers instead of a paste.
Key features
- Catalog they document
- Desktop toolkit
- Pin a listed server
- Vendor path
Why we like it
Most incidents start as an unpinned command. A catalog is the boring control.
Limits
Desktop-shaped. You still read what the server can do. Not a model firewall.
ToolHive
Best for run MCP servers in a box you isolate
ToolHive runs MCP servers with isolation they document. The server is not a raw npx on the same user as the browser.
Key features
- Isolated run
- Apache-2.0
- CLI they ship
- You operate the box
Why we like it
Inventory without isolation is a list of loaded guns.
Limits
You still allowlist which server starts. Isolation is not a proof the tool text is honest.
ContextForge MCP Gateway
Best for a gateway in front of servers you already trust
ContextForge is an MCP gateway. You put it in front of servers you operate and apply the controls they document.
Key features
- Gateway process
- Apache-2.0
- You host it
- IBM repo
Why we like it
When several clients should not each start their own stdio zoo, a gateway is the door.
Limits
Younger than Kong. You staff it. Not a jailbreak lab.
mcp-proxy
Best for stdio to HTTP on a host you own
mcp-proxy exposes an MCP stdio server over SSE or the reverse. Useful when the client and the server cannot share a process.
Key features
- stdio and SSE bridge
- MIT
- You run the process
- Simple surface
Why we like it
A bridge you can firewall is sometimes the whole program.
Limits
A proxy is not a scanner. Do not bridge a server you have never listed.
What the internet thinks about MCP security
MCP threads treat tool text as untrusted. We keep that line. This page will not replay a poisoning demo.
Prove MCP Inspector still publishes
Confirm the official inspector still publishes. Point it only at a server you operate.
git ls-remote --heads https://github.com/modelcontextprotocol/inspector.gitFAQs
Does this replace LLM security tools?
No. LLM security is output and retrieval. MCP is the tool bus. Link both.
Why did mcp-scan change names?
Invariant mcp-scan moved to Snyk Agent Scan. Same job, new steward. Use the live repo.
Will you teach a jailbreak?
No.
Is this a scored bake-off?
No. Order is editorial.
