MCP Security Scans
About
MCP Security Scans is a Python script that automates forking repositories from the mcp-agents-ai/mcp-agents-hub and enabling GitHub Advanced Security (GHAS) features on the forks. It is designed for developers and security teams who want to centralize and secure MCP server…
Details
- Author
- mcp-research
- Downloads
- 313
- Categories
- Developer Tools
Jump to
- Supports loading MCP server configurations from multiple repository sources.
- Authenticates with GitHub using a GitHub App.
- Forks repositories into a specified target organization.
- Checks for existing forks before creating new ones.
- Enables Dependency Scanning, Security Fixes, Secret Scanning, and Code Scanning.
- Reports total repos processed and Dependabot configuration status.
Setting up with Highlight
This MCP is not yet compatible with Highlight’s one-click setup. However, you can still use it with Highlight by following these steps:
- Download and install Highlight from highlightai.com/download
- Navigate to the plugins tab and select "Add Custom Plugin"
-
Configure the plugin with the settings below
Plugin Name
MCP Security ScansCommand (node, npx, python, etc.)Please refer to the README for specific instructions on how to obtain API keys or other required environment variables.
- Enable "Start Automatically" if you want the plugin to start when Highlight launches
From the repository
Clone the repository, create a Python virtual environment, install dependencies from requirements.txt and requirements-dev.txt, set up a GitHub App with required permissions, then set the GH_APP_ID and GH_APP_PRIVATE_KEY environment variables. Run python -m src.process_mcp_repos to fork and enable security features; optionally use --target-org to specify a different target organization.
Claude Desktop / Cursor
Paste into your MCP client config file to install this server.
{
"mcpServers": {
"mcp security scans": {
"mcp-security-scans": {
"command": "python",
"args": [
"-m",
"venv",
".venv"
]
}
}
}
}McpServers
{
"mcp-security-scans": {
"command": "python",
"args": [
"-m",
"venv",
".venv"
]
}
}MCP Security Scans
This project contains a Python script to automate the process of forking repositories listed in the mcp-agents-ai/mcp-agents-hub and enabling GitHub Advanced Security (GHAS) features on the forks.
Features
Supports loading MCP server configurations from multiple repository sources.
Currently includes support for the mcp-agents-ai/mcp-agents-hub repository.
Authenticates with GitHub using a GitHub App.
Forks the identified source repositories into a specified target organization (default: mcp-research).
Checks if a fork already exists before attempting to create one.
Enables the following GHAS features on the forks:
Dependency Scanning (via Vulnerability Alerts)
Automated Security Fixes
Secret Scanning
Code Scanning with Default Setup (if supported for the repository's language)
Checks if a .github/dependabot.yml file exists in each fork.
Reports the total number of repositories processed and the count of those with/without a Dependabot configuration.
Handles GitHub API errors and displays rate limit information.
Setup
1. Clone this repository:
git clone <your-repo-url>
cd mcp-security-scans
2. Create a Python virtual environment (recommended):
python -m venv .venv
source .venv/bin/activate # On Windows use .venv\Scripts\activate
3. Install dependencies:
pip install -r requirements.txt
pip install -r requirements-dev.txt
4. GitHub App Setup:
Create a GitHub App (e.g., under your user account or an organization).
Grant it the necessary permissions for the target organization (e.g., mcp-research):
Repository Permissions:
Administration: Read & Write (to enable security features, create forks)
Contents: Read & Write (to check for dependabot.yml, potentially needed for default setup)
Metadata: Read-only (default)
Secret scanning alerts: Read & Write
Code scanning alerts: Read & Write
Dependabot alerts: Read & Write
Organization Permissions:
Members: Read-only (to verify app installation)
Install the App on the target organization (mcp-research).
Generate a private key for the App and copy its contents.
Note the App ID.
5. Set Environment Variables:
Set the following environment variables in your shell or using a .env file (which is automatically loaded by the script):
export GH_APP_ID="YOUR_APP_ID"
export GH_APP_PRIVATE_KEY="-----BEGIN RSA PRIVATE KEY-----\\nYOUR_KEY_CONTENT_HERE\\n-----END RSA PRIVATE KEY-----"
Replace
YOUR_APP_ID with your App's ID.Replace the private key string with the actual content of your
.pem file, ensuring newlines (\\n) are preserved if setting directly in the shell or kept as actual newlines in a .env file.
Usage
Ensure the environment variables GH_APP_ID and GH_APP_PRIVATE_KEY are set. Then, run the script from the root directory of this project:
python -m src.process_mcp_repos # will process all repos found and fork them into the target org
python -m src.analyze --num-repos x # will analyze the forks and store found information into the forks repository properties
python -m src.report # will generate a report of the forks based on the information stored in the forks repository properties
Optional Arguments:
--target-org <org_name>: Specify a different target organization to fork into (defaults to mcp-research).
Example:
```bash
Sign in to leave a review
Use Google, GitHub, or an email account so ratings stay tied to real people.
No reviews posted yet.
