Hello
I built an open-source MCP security scanner, and here are the real results against DVMCP (including where it misses) I've been working on mcp-scanner for the past few weeks. It does static analysis, live dynamic testing with fuzzing, auth posture checks, SARIF/JSON reporting, and an A to F grade mapped to the OWASP MCP Top 10.
Instead of just claiming it works, I tested it against Damn Vulnerable MCP Server (DVMCP):
3 out of 10 canonical challenges fully detected, 1 out of 10 partially
4 out of 10 detected against the actual deployed Docker containers (which differ from DVMCP's own documentation on 6 out of 10 challenges, and I've documented that in the README)
0 out of 3 false positives on clean reference servers
The free tier covers static analysis, dynamic testing, and auth posture. It doesn't catch semantic tool poisoning or cross server toxic flow yet, since those need LLM based analysis, which I'm keeping as a separate paid layer because it's the expensive part to run at scale. I'd rather be upfront about that gap than hide it.
Any feedback is welcome, especially on what's missing or not working the way it should.