Server data from the Official MCP Registry
Scan MCP servers and skill files for AVE vulnerabilities. Conformance scoring and threat intel.
Scan MCP servers and skill files for AVE vulnerabilities. Conformance scoring and threat intel.
Bawbel MCP Server is a well-designed security scanner tool with appropriate authentication patterns, proper input validation, and safe dependency management. The server safely wraps the bawbel-scanner CLI, uses secure external API calls via urllib, and implements reasonable resource limits. Minor quality concerns around broad exception handling and subprocess invocation do not materially impact security given the server's purpose. Supply chain analysis found 3 known vulnerabilities in dependencies (1 critical, 1 high severity). Package verification found 1 issue.
3 files analyzed · 8 issues found
Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.
This plugin requests these system permissions. Most are normal for its category.
Add this to your MCP configuration file:
{
"mcpServers": {
"io-github-bawbel-bawbel-mcp": {
"args": [
"bawbel-mcp"
],
"command": "uvx"
}
}
}From the project's GitHub README.
Security scanner for MCP servers and agentic AI components, exposed as MCP tools.
Bawbel MCP Server lets any MCP-compatible agent scan servers, check skill files, score conformance, and query the AVE threat intelligence database mid-conversation.
pip install bawbel-mcp
Or with all detection engines (YARA, Semgrep, LLM, Magika):
pip install "bawbel-mcp[all]"
| Tool | Description |
|---|---|
scan_content | Scan raw text content for AVE vulnerabilities |
scan_server_card | Fetch and scan an MCP server-card before connecting |
check_conformance | Score a server manifest against the MCP spec (18 checks, A+ to F) |
lookup_ave | Get a full AVE record by ID with remediation guidance |
search_ave | Search AVE records by keyword |
list_ave | List all AVE records with optional severity/category filters |
check_pins | Detect rug pull drift in a directory of skill files |
| Resource | Description |
|---|---|
ave://stats | Current AVE database statistics |
ave://record/{ave_id} | Full AVE record for a specific ID |
Add to claude_desktop_config.json:
{
"mcpServers": {
"bawbel": {
"command": "uvx",
"args": ["bawbel-mcp"]
}
}
}
claude mcp add bawbel uvx bawbel-mcp
Add to your MCP settings:
{
"bawbel": {
"command": "uvx",
"args": ["bawbel-mcp"]
}
}
uvx bawbel-mcp --transport streamable-http --host 0.0.0.0 --port 8000
Scan a server before connecting:
"Before I add this MCP server to my config, scan it for security issues: https://api.some-mcp-server.com"
Claude calls scan_server_card("https://api.some-mcp-server.com") and reports any
findings with AVE IDs, severity, and remediation steps.
Check a skill file:
"Check this skill file content for prompt injection vulnerabilities: [paste content]"
Claude calls scan_content(content) and returns findings.
Score a server against the spec:
"Does this server follow the MCP spec? https://api.some-mcp-server.com"
Claude calls check_conformance("https://api.some-mcp-server.com") and returns
a score, grade, and list of failed checks.
Look up a vulnerability:
"What is AVE-2026-00041 and how do I fix it?"
Claude calls lookup_ave("AVE-2026-00041") and returns the full record with
behavioral fingerprint, IOCs, and remediation steps.
Search for relevant vulnerabilities:
"What AVE records cover credential exfiltration?"
Claude calls search_ave("credential exfiltration") and returns matching records.
bawbel-scanner>=1.1.1 (installed automatically)fastmcp>=3.0.0 (installed automatically)The bawbel CLI must be available in PATH. Installing bawbel-mcp installs
bawbel-scanner which provides the bawbel CLI.
Apache 2.0. Built by Bawbel.
Be the first to review this server!
by Modelcontextprotocol · Developer Tools
Read, search, and manipulate Git repositories programmatically
by Toleno · Developer Tools
Toleno Network MCP Server — Manage your Toleno mining account with Claude AI using natural language.
by mcp-marketplace · Developer Tools
Create, build, and publish Python MCP servers to PyPI — conversationally.