cisco-ai-defense/mcp-scanner

Why it got this result

A repo-wide search finds no CORS configuration at all in the codebase -- the FastAPI app never registers CORSMiddleware. Because no CORS middleware is registered, the specific misconfiguration this rule targets (wildcard origin combined with credentialed CORS) cannot occur -- the app simply never emits CORS response headers, so browsers apply the default same-origin policy to any response. The broader gap of no Origin/Host validation at all is captured separately under the DNS-rebinding rule.

Why it matters

Prevents credentialed cross-origin abuse.

Evidence

app = FastAPI(
    title="MCP Scanner SDK API",
    description="An API to scan MCP server tools for security findings using both Cisco AI Defense and custom YARA rules.",
    version="1.0.0",
)

Why it got this result

The REST scanning API lacks OAuth 2.1/PKCE protection for incoming callers, but it is not an MCP remote transport endpoint; it operates as an outbound MCP client toward a caller-supplied server_url. OAuth 2.1 + PKCE correctness requirements under the MCP Authorization spec govern MCP protocol server endpoints, not this REST API's client-side role, so this rule does not apply here. Any missing incoming authentication on the REST API is a separate access-control concern.

Why it matters

Misconfig enables token theft and confused-deputy attacks.

Affected tools

Evidence

app.include_router(api_router)

# Provide the dependency override for the default scanner
app.dependency_overrides[get_scanner] = create_default_scanner_factory

async def scan_tool_endpoint(
    request: SpecificToolScanRequest,
    http_request: Request,
    scanner_factory: ScannerFactory = Depends(get_scanner),
):
    ...
        auth = None
        if request.auth:
            if request.auth.auth_type == AuthType.BEARER:
                auth = Auth.bearer(request.auth.bearer_token)
            elif request.auth.auth_type == AuthType.APIKEY:
                auth = Auth.apikey(request.auth.api_key, request.auth.api_key_header)
        result = await scanner.scan_remote_server_tool(
            server_url=request.server_url,
…

# MCP Scanner as REST API
mcp-scanner-api --host 0.0.0.0 --port 8080

+1 more location in the finding JSON

Why it got this result

The FastAPI routes lacking authentication are part of the project's REST scanning API rather than an MCP protocol server exposing tools/resources; this rule's MCP-server-scoped authentication requirement does not apply to this component's architecture.

Why it matters

Prevents unauthorized tool use and data access.

Affected tools

Evidence

def create_default_scanner_factory() -> ScannerFactory:
    def scanner_factory(
        analyzers: List[AnalyzerEnum], rules_path: Optional[str] = None
    ) -> Scanner:
        (
            api_key, endpoint_url, llm_api_key, aws_region,
            aws_session_token, aws_profile,
        ) = _prepare_scanner_config(analyzers)
        config = Config(
            api_key=api_key, endpoint_url=endpoint_url,
            llm_provider_api_key=llm_api_key, llm_model=LLM_MODEL,
            aws_region_name=aws_region, aws_session_token=aws_session_token,
            aws_profile_name=aws_profile,
        )
…

async def scan_tool_endpoint(
    request: SpecificToolScanRequest,
    http_request: Request,
    scanner_factory: ScannerFactory = Depends(get_scanner),
):
    """Scan a specific tool on an MCP server."""
    logger.debug(
        f"Starting tool scan - server: {request.server_url}, tool: {request.tool_name}"
    )

    try:
        analyzers = request.resolved_analyzers()
        scanner = scanner_factory(analyzers)

# MCP Scanner as REST API
mcp-scanner-api --host 0.0.0.0 --port 8080

Why it got this result

mcp-scanner is not an OAuth proxy: it does not forward authorization requests to a distinct upstream IdP on behalf of registered MCP clients, nor does it expose any dynamic MCP-client registration endpoint. Its auth plumbing is used by the scanner itself as an outbound client credential to authenticate to the MCP server being scanned -- a single operator-supplied credential per scan request, not a shared upstream client_id multiplexed across dynamically-registered downstream clients. There is no registration/DCR endpoint, no bridge-code minting, and no consent UI concept anywhere in the codebase.

Why it matters

Shared upstream client + dynamic MCP-client registration + no per-client consent enables attacker-registered MCP clients to receive bridge codes carrying victim upstream tokens — the documented MCP Confused Deputy attack.

Evidence

(file provides Auth.bearer/Auth.apikey/Auth.oauth helpers used as outbound credentials supplied per-request by the operator; no upstream IdP proxying, no dynamic client registration endpoint exists in the repository)

Why it got this result

mcp-scanner does not register or expose MCP tools of its own to an MCP client in the ETDI sense this rule targets. It is a scanning utility: its own capability surface is a fixed set of FastAPI REST endpoints and CLI subcommands defined in source and shipped/versioned with the Python package, not a dynamic/updatable tool manifest fetched at runtime. There is no tool-definition loading/hot-reload mechanism for its own capabilities.

Why it matters

Prevents rug-pull tool poisoning.

Evidence

(REST endpoints and CLI subcommands are defined statically in source and versioned with the package release; no runtime tool-manifest fetch/hot-reload exists for the scanner's own capability surface)

Why it got this result

mcp-scanner's capability surface consists of REST endpoints and CLI subcommands, not first-party MCP tools registered for model dispatch; treating every REST/CLI operation as an MCP tool misapplies this rule's per-tool capability-scoping requirement. Any exposure from unrestricted target server_url values or missing REST authentication is more appropriately assessed under SSRF and access-control rules rather than MCP tool permission scoping.

Why it matters

Limits blast radius and privilege escalation.

Affected tools

Evidence

@router.post(
    "/scan-tool",
    response_model=Union[ToolScanResult, FormattedToolScanResponse],
    tags=["Scanning"],
)
async def scan_tool_endpoint(
    request: SpecificToolScanRequest,
    http_request: Request,
    scanner_factory: ScannerFactory = Depends(get_scanner),
):
    """Scan a specific tool on an MCP server."""

class APIScanRequest(BaseModel):
    """Base request for scanning MCP servers via API."""

    server_url: str
    analyzers: List[AnalyzerEnum] = Field(
        default=[AnalyzerEnum.API, AnalyzerEnum.YARA, AnalyzerEnum.LLM],
        ...
    )

# MCP Scanner as REST API
mcp-scanner-api --host 0.0.0.0 --port 8080

Why it got this result

The reviewed endpoint acts as an MCP client that connects outward to a caller-supplied remote MCP server; it is not an MCP HTTP/SSE/streamable-HTTP listener subject to DNS-rebinding Origin/Host validation requirements, so this rule does not apply to this component.

Why it matters

Prevents DNS rebinding/browser hijack of local or remote MCP.

Affected tools

Evidence

app = FastAPI(
    title="MCP Scanner SDK API",
    description="An API to scan MCP server tools for security findings using both Cisco AI Defense and custom YARA rules.",
    version="1.0.0",
)

        result = await scanner.scan_remote_server_tool(
            server_url=request.server_url,
            tool_name=request.tool_name,
            auth=auth,
            analyzers=analyzers,
            http_headers=http_headers,
            **_hybrid_routing_kwargs(request),
        )

# MCP Scanner as REST API
mcp-scanner-api --host 0.0.0.0 --port 8080

Why it got this result

The non-TLS, non-authenticated 0.0.0.0 bind documented in the README governs the project's FastAPI REST scanning API rather than an MCP server transport; this rule's MCP-server-scoped binding requirement does not apply to this component's architecture, and any exposure here should be assessed under API-server policy.

Why it matters

LAN/Internet exposure enables remote exploitation.

Affected tools

Evidence

    # Start the server
    uvicorn.run(
        "mcpscanner.api.api:app", host=args.host, port=args.port, reload=args.reload
    )

# MCP Scanner as REST API
mcp-scanner-api --host 0.0.0.0 --port 8080

# Include the reusable router
app.include_router(api_router)

# Provide the dependency override for the default scanner
app.dependency_overrides[get_scanner] = create_default_scanner_factory


@app.get("/health", tags=["Health"])
async def health_check():
    """Health check endpoint."""
    return {"status": "healthy"}

Why it got this result

The uvicorn listener started without TLS options serves the project's FastAPI REST scanning API, not a remote MCP SSE/streamable-HTTP transport; this rule's remote-MCP-transport applicability condition is not met for this component.

Why it matters

MitM can steal tokens and tamper responses.

Affected tools

Evidence

    parser.add_argument(
        "--host",
        default=CONSTANTS.DEFAULT_SERVER_HOST,
        help="Host to bind the server to",
    )
    parser.add_argument(
        "--port",
        type=int,
        default=CONSTANTS.DEFAULT_SERVER_PORT,
        help="Port to bind the server to",
    )
    parser.add_argument(
        "--reload", action="store_true", help="Enable auto-reload for development"
    )

    # Start the server
    uvicorn.run(
        "mcpscanner.api.api:app", host=args.host, port=args.port, reload=args.reload
    )

mcp-scanner-api --port 8000

# Or with custom host and port
mcp-scanner-api --host 0.0.0.0 --port 8080

# Enable development mode with auto-reload
mcp-scanner-api --reload

Why it got this result

mcp-scanner's own exposed capability surface consists of REST paths (e.g. /scan-tool, /scan-all-tools, /scan-prompt, /scan-resource, /scan-instructions, /health) and CLI subcommands, not MCP protocol tool registrations consumed by a model client for dispatch. The tool-name-collision/spoofing threat model this rule targets concerns MCP tool name clashes seen by a model client, which does not apply to this component's REST/CLI architecture.

Why it matters

Prevents malicious tool shadowing.

Evidence

@router.post(
    "/scan-tool",
    response_model=Union[ToolScanResult, FormattedToolScanResponse],
    tags=["Scanning"],
)

Why it got this result

This component is a conventional FastAPI REST API that scans other MCP servers; it does not expose MCP tool metadata of its own for a model client to select from. The cited text (e.g. router.py docstrings like 'Scan a specific tool on an MCP server.') is a Python endpoint docstring, not MCP tool-description metadata surfaced to an LLM for tool selection, so the metadata-injection threat model this rule targets does not match this component's architecture.

Why it matters

Prevents covert model manipulation.

Evidence

    """Scan a specific tool on an MCP server."""
    logger.debug(
        f"Starting tool scan - server: {request.server_url}, tool: {request.tool_name}"
    )

Why it got this result

The plugin's manifest and all 8 slash-command markdown files declare a single, consistent purpose: invoke the mcp-scanner CLI to scan MCP servers/configs/prompts/resources for security findings. Every command body is a literal mcp-scanner shell invocation whose flags map 1:1 to the declared action. There are no bundled executables, no hidden network calls to undeclared hosts, no credential-store reads, and no obfuscation anywhere in the plugin directory. The plugin ships zero scripts/hooks -- only markdown command definitions and a skill doc -- so there is no undisclosed capability to exercise.

Why it matters

Install-time trust is granted from the artifact's self-description, so any bundled capability the description does not disclose -- network egress, credential reads, or subprocess execution -- runs as an unconsented backdoor with the host agent's full privileges.

Evidence

---
description: Scan a remote MCP server for security threats and risks
---

# Scan Remote MCP Server

Scan the remote MCP server at URL "$ARGUMENTS" for security threats and risks.

Run the following command:
```bash
mcp-scanner --analyzers yara --format detailed remote --server-url "$ARGUMENTS"
```

Why it got this result

A keyword scan of all manifest/command markdown/README content for consent-suppression phrasing returns zero matches. Every command instructs the model to run one specific documented CLI invocation and then summarize results -- none direct the model to hide actions from the user or bypass the host's own tool-confirmation UX.

Why it matters

Because a skill/plugin instruction body is ingested as trusted first-party context, consent- or oversight-suppressing prose inherits the host's full authority and turns a passive package into a self-authorizing backdoor that strips the human-in-the-loop control from every action it can reach.

Evidence

---
description: Deep security scan using all analyzers (YARA, LLM, and Cisco AI Defense API)
---

# Deep Security Scan

Perform a comprehensive security scan of the MCP server at "$ARGUMENTS" using all available analyzers.

Run the following command:
```bash
mcp-scanner --analyzers yara,llm,api --format detailed remote --server-url "$ARGUMENTS"
```

If the URL is not provided, ask the user for the MCP server URL.

Why it got this result

The plugin manifest declares no allowed-tools/permissions block at all, no wildcard capability grant, and no OAuth scope request. It ships zero executables, no package.json bin/postinstall, and no lifecycle hooks. Its commands document shelling out to the already-separately-installed mcp-scanner CLI via the host's normal Bash tool -- functionality intrinsic to a security-scanning plugin's stated purpose. There is no self-declared capability class beyond invoking one documented CLI tool for the plugin's sole documented function.

Why it matters

An artifact that self-declares host privilege far beyond its stated function -- or hides executable reach inside a passive-looking package -- gives a single install a blast radius the operator never scoped, so any later mistake, compromise, or misconfiguration detonates across resources the artifact never needed.

Evidence

{
  "name": "mcp-scanner",
  "description": "Security scanning for MCP servers using YARA rules, LLM analysis, and Cisco AI Defense. Detect prompt injection, tool poisoning, and other threats in MCP tools, prompts, and resources.",
  "version": "1.0.0",
  "author": {
    "name": "Cisco AI Defense"
  },
  "repository": "https://github.com/cisco-ai-defense/mcp-scanner",
  "license": "Apache-2.0",
  "keywords": ["security", "mcp", "scanning", "yara", "threat-detection"]
}

Why it got this result

A codepoint scan of the manifest, README, and all 8 command markdown files found zero non-ASCII characters and no forged chat-template tokens, ANSI/OSC escapes, or HTML-comment/CSS-hidden concealment. A keyword scan for host-directed imperatives also returned no matches. All model-facing carrier text is purely descriptive task guidance.

Why it matters

A skill or plugin's always-loaded manifest and instruction carriers (frontmatter/body, `description_for_model`, Gemini `FunctionDeclaration.description` / Vertex AI extension `manifest` / ADK agent `instruction`, tool docstrings, JSON-Schema descriptions) are concatenated into the host agent prompt at operator privilege, so a directive that is hidden with non-printing codepoints, disguised with a homoglyph, forged with role-control tokens, or masked from the rendered view silently commandeers model behavior toward attacker-chosen actions across every tool the artifact serves -- with no code execution required and nothing visible to a reviewer reading the rendered text.

Evidence

---
description: Quick YARA-only scan of an MCP server (no API keys required)
---

# Quick Security Scan

Perform a quick YARA-based security scan of the MCP server at "$ARGUMENTS".

This scan uses only YARA rules and does not require any API keys.

Run the following command:
```bash
mcp-scanner --analyzers yara --format summary remote --server-url "$ARGUMENTS"
```

Why it got this result

The plugin's model-facing instructions ship entirely inside the git-tracked bundle at this commit -- none are fetched at runtime from a publisher-mutable endpoint; there is no fetch/load call anywhere in the plugin that retrieves instructions or manifest content from a remote URL, and no auto-update/hot-reload logic exists in the plugin files themselves. There is no self-mutation code.

Why it matters

A skill/plugin reviewed once and then trusted indefinitely becomes a rug-pull vector when its OWN model-facing instruction body, declared scope, or manifest can be live-swapped or silently mutated after approval -- without an approval-time digest that is re-compared on load and re-consent on any change, a publisher (or an attacker who compromises the distribution channel) can rewrite the artifact's trusted instructions or widen its tool scope under authority the host already granted, turning an approved package into an exfiltration or unauthorized-action backdoor.

Evidence

### Install Plugin

Load the plugin in Claude Code:

```bash
claude --plugin-dir /path/to/claude-code-plugin
```

Or install from a marketplace if published.

Why it got this result

The plugin's declared name 'mcp-scanner' is a generic, accurate description of its own function -- not a near-miss/typosquat/homoglyph of any well-known third-party tool, provider, or registry name. The publisher is the verifiable source-host org: the repo origin matches the manifest's repository and author fields exactly. No trust-implying prefix, version-spoofing suffix, or impersonation prose appears anywhere in the manifest or README.

Why it matters

Impersonation is the entry point of the agentic supply chain (OWASP LLM ASI04 / MITRE ATT&CK T1195): a skill or plugin installed on the strength of a familiar name inherits the host agent's execution context before any payload runs. The deception front-runs trust, so catching the identity lie breaks the chain at the cheapest point -- and it is independent of whether the current code is benign, because the same trusted-looking name can ship a payload in the next version.

Evidence

{
  "name": "mcp-scanner",
  "description": "Security scanning for MCP servers using YARA rules, LLM analysis, and Cisco AI Defense. Detect prompt injection, tool poisoning, and other threats in MCP tools, prompts, and resources.",
  "version": "1.0.0",
  "author": {
    "name": "Cisco AI Defense"
  },
  "repository": "https://github.com/cisco-ai-defense/mcp-scanner",

Why it got this result

This rule's subject is the pair of a harvest of host credentials or conversation/memory context and an exfil channel. The plugin's manifest and command markdown files never direct the agent to read any credential store or the model's own conversation/system-prompt/memory state -- the only environment variables referenced are the scanner's own documented, functionally-required configuration. No harvest step exists, so no harvest+exfil pair is constructible.

Why it matters

A skill or plugin that couples a host-credential or live-conversation read with an outbound channel turns an ostensibly benign helper into an autonomous exfiltration agent, leaking long-lived secrets, session tokens, and confidential prompt context to an attacker on every invocation across every tool the artifact serves.

Evidence

---
description: Deep security scan using all analyzers (YARA, LLM, and Cisco AI Defense API)
---

# Deep Security Scan

Perform a comprehensive security scan of the MCP server at "$ARGUMENTS" using all available analyzers.

Run the following command:
```bash
mcp-scanner --analyzers yara,llm,api --format detailed remote --server-url "$ARGUMENTS"
```

**Requirements:**
…

Why it got this result

The plugin ships none of the format-native execution/control-plane primitives this rule scopes to: no lifecycle/event hooks, no bundled entry scripts or binaries, no install/build steps, no git hooks, and no env-var assignments anywhere in the bundle. Commands are plain markdown instructing the model to invoke the already-registered Bash tool through the host's normal consent-gated flow -- not a format-native primitive per the rule's own scope guidance.

Why it matters

Format-native execution and control-plane writes bypass the model's reasoning loop, converting a single install approval into durable, self-reinjecting code execution that can MITM the host agent's own model endpoint and silently subvert every subsequent tool call.

Evidence

{
  "name": "mcp-scanner",
  "description": "Security scanning for MCP servers using YARA rules, LLM analysis, and Cisco AI Defense. Detect prompt injection, tool poisoning, and other threats in MCP tools, prompts, and resources.",
  "version": "1.0.0",
  "author": {
    "name": "Cisco AI Defense"
  },

Why it got this result

SKILL.md's declared purpose matches its body exactly: every example invokes uv run mcp-scanner with flags documented in the main project README, with no undisclosed network egress, credential reads, or exec capability beyond running the already-declared CLI.

Why it matters

Install-time trust is granted from the artifact's self-description, so any bundled capability the description does not disclose -- network egress, credential reads, or subprocess execution -- runs as an unconsented backdoor with the host agent's full privileges.

Evidence

---
name: mcp-security-scan
description: Scans MCP servers, tools, prompts, and resources for security vulnerabilities using YARA rules, LLM analysis, and Cisco AI Defense API. Use this skill when the user wants to check MCP servers for security issues, detect prompt injection, tool poisoning, or analyze MCP configurations for threats.
---

# MCP Security Scanning

When the user asks to scan MCP servers or check for security issues in MCP configurations, use the `uv run mcp-scanner` CLI tool.

Why it got this result

SKILL.md contains purely descriptive, task-scoped prose with no consent-suppression or authority-override language; a keyword scan for bypass/silently/auto-approve/override-system-prompt phrasing returns zero matches.

Why it matters

Because a skill/plugin instruction body is ingested as trusted first-party context, consent- or oversight-suppressing prose inherits the host's full authority and turns a passive package into a self-authorizing backdoor that strips the human-in-the-loop control from every action it can reach.

Evidence

## Best Practices

1. **Start with YARA**: Use `--analyzers yara` for quick initial scans (no API keys needed)
2. **Add LLM for depth**: Include `llm` analyzer for semantic analysis of suspicious tools
3. **Use detailed format**: Use `--format detailed` when investigating findings
4. **CI/CD integration**: Use static scanning with `--format raw` for pipeline integration
5. **Scan before install**: Always scan new MCP servers before adding to your configuration
6. **Regular rescans**: Periodically rescan existing configurations for new threats

Why it got this result

SKILL.md frontmatter declares only name/description, no allowed-tools wildcard or broad scope block, and the skill's sole function is to shell out to the mcp-scanner CLI -- a capability intrinsic to and fully justified by its declared security-scanning purpose. No bundled executables, install hooks, or credential/env reach beyond the scanner's own documented config vars.

Why it matters

An artifact that self-declares host privilege far beyond its stated function -- or hides executable reach inside a passive-looking package -- gives a single install a blast radius the operator never scoped, so any later mistake, compromise, or misconfiguration detonates across resources the artifact never needed.

Evidence

---
name: mcp-security-scan
description: Scans MCP servers, tools, prompts, and resources for security vulnerabilities using YARA rules, LLM analysis, and Cisco AI Defense API. Use this skill when the user wants to check MCP servers for security issues, detect prompt injection, tool poisoning, or analyze MCP configurations for threats.
---

Why it got this result

SKILL.md was scanned programmatically for zero-width/bidi-override/Tag-block codepoints (none found -- file is 7-bit ASCII aside from standard markdown) and for forged chat-template tokens/ANSI escapes/HTML-comment concealment (none found). All content is descriptive analyzer/command documentation with no host-directed imperatives.

Why it matters

A skill or plugin's always-loaded manifest and instruction carriers (frontmatter/body, `description_for_model`, Gemini `FunctionDeclaration.description` / Vertex AI extension `manifest` / ADK agent `instruction`, tool docstrings, JSON-Schema descriptions) are concatenated into the host agent prompt at operator privilege, so a directive that is hidden with non-printing codepoints, disguised with a homoglyph, forged with role-control tokens, or masked from the rendered view silently commandeers model behavior toward attacker-chosen actions across every tool the artifact serves -- with no code execution required and nothing visible to a reviewer reading the rendered text.

Evidence

---
name: mcp-security-scan
description: Scans MCP servers, tools, prompts, and resources for security vulnerabilities using YARA rules, LLM analysis, and Cisco AI Defense API. Use this skill when the user wants to check MCP servers for security issues, detect prompt injection, tool poisoning, or analyze MCP configurations for threats.
---

# MCP Security Scanning

When the user asks to scan MCP servers or check for security issues in MCP configurations, use the `uv run mcp-scanner` CLI tool.

Why it got this result

SKILL.md ships inside the static plugin bundle with no runtime fetch of its own instruction body from any remote/mutable endpoint, and no self-mutation logic exists anywhere in the skill directory.

Why it matters

A skill/plugin reviewed once and then trusted indefinitely becomes a rug-pull vector when its OWN model-facing instruction body, declared scope, or manifest can be live-swapped or silently mutated after approval -- without an approval-time digest that is re-compared on load and re-consent on any change, a publisher (or an attacker who compromises the distribution channel) can rewrite the artifact's trusted instructions or widen its tool scope under authority the host already granted, turning an approved package into an exfiltration or unauthorized-action backdoor.

Evidence

---
name: mcp-security-scan
description: Scans MCP servers, tools, prompts, and resources for security vulnerabilities using YARA rules, LLM analysis, and Cisco AI Defense API.
---

Why it got this result

The skill's declared name 'mcp-security-scan' is descriptive of its own function and is not a near-miss of any third-party brand/tool name; it is distributed as part of the same repository/publisher verified for the parent plugin component, with no impersonation prose or trust-implying prefixes anywhere in SKILL.md.

Why it matters

Impersonation is the entry point of the agentic supply chain (OWASP LLM ASI04 / MITRE ATT&CK T1195): a skill or plugin installed on the strength of a familiar name inherits the host agent's execution context before any payload runs. The deception front-runs trust, so catching the identity lie breaks the chain at the cheapest point -- and it is independent of whether the current code is benign, because the same trusted-looking name can ship a payload in the next version.

Evidence

---
name: mcp-security-scan
description: Scans MCP servers, tools, prompts, and resources for security vulnerabilities using YARA rules, LLM analysis, and Cisco AI Defense API. Use this skill when the user wants to check MCP servers for security issues, detect prompt injection, tool poisoning, or analyze MCP configurations for threats.
---

Why it got this result

Same analysis as the parent plugin component: SKILL.md documents the scanner's own required env vars but contains no instruction to read host credential stores or conversation/memory context and route it elsewhere. No harvest step exists, so the harvest+exfil pair this rule requires cannot be constructed.

Why it matters

A skill or plugin that couples a host-credential or live-conversation read with an outbound channel turns an ostensibly benign helper into an autonomous exfiltration agent, leaking long-lived secrets, session tokens, and confidential prompt context to an attacker on every invocation across every tool the artifact serves.

Evidence

## Environment Variables
### Core Configuration
export MCP_SCANNER_API_KEY="your_cisco_api_key"
export MCP_SCANNER_ENDPOINT="https://us.api.inspect.aidefense.security.cisco.com/api/v1"
### LLM Configuration
export MCP_SCANNER_LLM_API_KEY="your_openai_api_key"
export MCP_SCANNER_LLM_MODEL="gpt-4o"

Why it got this result

SKILL.md is a pure markdown instruction document with no bundled scripts, hooks, lifecycle events, or env-var assignments of its own -- it only documents invoking the mcp-scanner CLI via the host's normal consent-gated Bash tool. No format-native execution/control-plane primitive is shipped, so the rule's subject does not exist here.

Why it matters

Format-native execution and control-plane writes bypass the model's reasoning loop, converting a single install approval into durable, self-reinjecting code execution that can MITM the host agent's own model endpoint and silently subvert every subsequent tool call.

Evidence

---
name: mcp-security-scan
description: Scans MCP servers, tools, prompts, and resources for security vulnerabilities using YARA rules, LLM analysis, and Cisco AI Defense API. Use this skill when the user wants to check MCP servers for security issues, detect prompt injection, tool poisoning, or analyze MCP configurations for threats.
---