mcp-patch

Static security scanner for Python MCP server code.

43% of popular MCP servers have shell injection vulnerabilities. No existing tool does AST-level scanning with MCP context awareness. This one does.

• CVE-2025-53967 (Framelink Figma MCP) — shell injection via unsanitized tool parameters
• CVE-2025-6514 (mcp-remote, 437K downloads) — arbitrary command execution via unsanitized tool params

pip install mcp-patch
mcp-patch scan my_server.py

# Scan a single file
mcp-patch scan server.py

# Scan a directory
mcp-patch scan ./servers/

Scanning server.py...

  CRITICAL  shell_injection  line 14
  subprocess.run(f"ls {path}", shell=True)
  subprocess.run(shell=True) — tool param 'path' flows to shell
  Fix: Use subprocess.run([cmd, shlex.quote(arg)]) without shell=True

  HIGH      path_traversal   line 28
  open(filename)
  open(filename) — tool param 'filename' used as file path without validation
  Fix: Use (base_dir / Path(filename).name).resolve() and verify result starts with base_dir

Found 2 issues (1 CRITICAL, 1 HIGH) in 1 file.

| Check | Severity | What it detects | |---|---|---| | shell_injection | CRITICAL | subprocess.run/Popen/call(f"...{param}", shell=True), os.system(), os.popen() with tool params | | path_traversal | HIGH | open(param), Path(param) with a tool param passed directly as a path | | ssrf | HIGH | requests.get/post(url), httpx.get(url), urllib.request.urlopen(url) where url is a tool param |

Only functions decorated with @tool or @mcp.tool() are scanned. Plain helper functions are ignored.

Pure stdlib. No network calls. No LLM. Parses your Python source with the ast module, finds @tool decorated functions, collects their parameter names, then walks each function body looking for dangerous call patterns where user-controlled params flow into dangerous sinks.