Secure your AI agents. Scan MCP servers and Agent Skills before attackers do.
49 security rules aligned with OWASP Agentic AI Top 10, OWASP Agentic Skills Top 10, and OWASP MCP Top 10, across four scan surfaces. Free and open source. Built on .NET 10 with defence-grade governance.
Signal Sentinel Scanner is a fast, deterministic, offline-capable first-pass authoring aid for MCP operators and skill authors. Pair it with Bandit, Gitleaks, Semgrep, and Sentinel Gateway for defence in depth.
_
Four attack surfaces. One scanner.
Signal Sentinel Scanner performs static and runtime security analysis across the full agent supply chain.
MCP servers
Scans local configuration files and connects to remote servers over stdio, HTTP/SSE, Streamable HTTP and WebSocket. v3.0.0 extended enumeration beyond tools to prompts, resources, server instructions and unsolicited server-to-client requests, closing the gap where a server could carry a clean tool list and a poisoned prompt.
Agent Skills
Scans SKILL.md files and bundled scripts for prompt injection, credential exposure, data exfiltration, obfuscation, unpinned supply-chain dependencies and malicious payloads.
MCP server source code New in v3.0
Points at a server's own repository and performs static analysis over JavaScript, TypeScript and Python for dangerous sinks, so a server can be assessed before it is ever run.
A2A Agent Cards New in v3.0
Evaluates Agent2Agent capability declarations, including cards served from a bare origin, for undeclared authentication and injection in the advertised capability set.
Every finding is mapped to the OWASP Agentic AI Security Top 10, the OWASP Agentic Skills Top 10 and the OWASP MCP Top 10, producing a scored A-F (or Inconclusive) grade with prioritised remediation guidance. The scanner claims every category in the Agentic AI and MCP frameworks, and eight of ten in Agentic Skills. The two remaining categories, No Governance and Cross-Platform Reuse, are named in the rule mapping documentation with the reason each is not covered.
What's new in v3
v3.1.0 (27 September 2026) adds two rules, taking the total to 49. v3.0.0 (20 September 2026) added two scan surfaces and fifteen rules, from 32 to 47; v3.0.1 to v3.0.4 were precision and release-pipeline patches.
New in v3.1.0
Dangerous Constructs in Shipped Skill Metadata
Reads a skill’s .yaml, .json and .toml sidecars, not just its manifest and scripts, and flags code-executing YAML tags, prototype-pollution keys, and duplicate keys or tables where two parsers would disagree. High when a consuming operation ships alongside the construct, Medium for the construct alone.
MCP Logging Capability Absent
Reports when a server does not advertise the MCP logging capability, so its operations cannot be audited through the protocol. It states only that the capability is not advertised; it does not claim the server keeps no logs of its own, which cannot be known from outside.
New scan surfaces (v3.0.0)
Server Source Dangerous Sink
Static analysis of an MCP server’s own JavaScript, TypeScript or Python source for dangerous sinks near tool registrations, so a server can be assessed before it is run.
A2A Agent Card Evaluation
Assesses Agent2Agent cards for undeclared authentication and injection in the advertised capability set, resolving a bare origin to its well-known card path.
Wider MCP coverage
Prompt and Resource Poisoning
Injection scanning of prompt and resource surfaces, including resources that advertise credential material by name, URI or description.
Server Instructions Injection
Catches a server whose instructions block attempts to steer the client agent, including cross-server steering directives.
Unsolicited Server-to-Client Request
Flags a server that initiates requests the client did not ask for. Sampling requests are Critical; elicitation and roots requests are High.
Error-Channel Injection
Injection delivered through error and result channels rather than descriptions, including captured JSON-RPC error bodies.
MCP Capability Surface
Informational record of what the server actually exposed: listChanged, experimental and completions capabilities per server.
Beyond the tool list
Enumeration now captures server instructions, unsolicited requests and protocol error bodies as rule input, not just tools, prompts and resources.
Skill forensics and supply chain
Skill Integrity Mismatch
Verifies SHA256SUMS and signature artefacts, and reports a mismatch rather than merely a missing signature.
Suspicious File Artefact
Flags opaque content shipped inside a skill package, such as archives a reviewer cannot read, hidden binaries, double extensions and orphan .pyc files.
Unicode Confusable Identifier
UTS #39-style homoglyph detection across tool, prompt, resource, server and skill names, covering impersonation of a trusted marketplace skill.
Cross-Skill Description Overlap
Detects one skill shadowing another’s trigger conditions.
Skill Script Pipeline Taint
Line-oriented fetch-to-exec taint analysis across Bash, Zsh, PowerShell, Python and JavaScript, direct and base64-encoded.
Dependency Known Vulnerability
Opt-in lookup of pinned skill dependencies against the OSV database. Network egress, and refused under --offline; without it, the unchecked surface is listed as an informational finding.
Governance, control and correctness
Policy Presets
strict raises supply-chain rules one severity band and fails at Medium. defence raises everything one band, fails at Low and implies --offline. A JSON policy file gives per-rule overrides.
Versioned Scoring Rubric
Deductions, grade rules and thresholds are an auditable JSON document rather than a hard-coded algorithm, overridable per organisation, with property-tested monotonicity. An invalid rubric fails closed.
Explicit Private-Target Opt-in
Required before --remote will touch a loopback, RFC1918 or link-local address. Without it, such targets are refused.
Markdown-Aware Skill Rules
Skill documents are parsed into frontmatter, prose, fenced code, inline code, link and HTML segments, and each rule evaluates only the segments where its signal means anything. Injection words inside a fenced example no longer fire.
Nothing Assessed, Nothing Graded
A scan that connected to nothing and scanned no skills reports Inconclusive, so it cannot present a misleading A.
CI-Safe Argument Handling
Argument and policy rejections exit 2 rather than exiting 0 with the full help text, which matters for anyone wiring the scanner into CI.
v3.0.1 and v3.0.2 (September 2026). Precision patches.
Skill rules now require a shaped match rather than a keyword: a capability claim needs a verb and a target, an exfiltration finding needs a destination, and a credential finding needs an access form. YAML block-scalar descriptions parse correctly. The grade can no longer read better than the score it is derived from. No rule was removed and no detection capability for real attack patterns was given up.
Validated against real-world code, not synthetic tests
A scanner that has only ever been tested against strings its authors wrote will be tuned to those strings. In September 2026 we ran Signal Sentinel Scanner against a third-party corpus it had never seen: the nineteen skills Anthropic publishes as reference examples.
The first run graded that corpus F, with four Critical findings. Every one of those four was a false positive. The word “request” was being read as network access. The phrase “input file to” was matching an outbound HTTP verb. A <script> tag inside a fenced HTML example was being treated as hidden content in the document itself.
We fixed the class rather than the symptoms, and committed that corpus as a permanent regression fixture. The same corpus now produces zero findings in those categories, and the only High-severity findings that remain are genuine: scripts that build a shell command dynamically at runtime.
One defect found during that work was not ours. A lazy bounded loop in a regular expression was causing the .NET compiled and source-generated engines to return a fabricated match where the interpreter correctly found nothing, which had reached one of our shipped releases. We reported it to the .NET team, who confirmed it and identified the fix. The scanner now carries two permanent guards: no shipped pattern may use the affected construct, and every pattern's output is compared across both engines on every build.
Measured, not asserted
For v3.1.0 we measured the scanner against a third-party labelled corpus: 33 deliberately vulnerable skills and 33 matched benign twins built on the same themes. It detected 72% of the vulnerable skills, and fired on 27% of the benign twins. On Anthropic's 19 public skills it produces no false-positive classes; the only High-severity findings are genuine dynamic subprocess calls in their own tooling.
Those figures come with their qualification attached. It is one corpus encoding one author's judgement of what counts as vulnerable, its benign controls sit adversarially close to the positives by design, and 33 pairs is a small sample. It is not a general accuracy figure, and we do not describe the scanner as “72% accurate”. The full measurement, including the per-category breakdown and the regression it caught before release, is in the repository.
Release history
Earlier releases from v2.2.0 to v2.5.1, for readers upgrading from an older version.
v2.5.1 – Skill-scanner false-positive remediation (August 2026)
A real-world reviewer ran the scanner offline against 65 production Claude Skills. The initial result looked bad — Grade F, 584 findings, 84 Critical — but manual review told a more useful story. 489 were false positives, all traced to the same seven rule bugs and fixed with regression tests for both the false positive and a genuine-intent counterpart that must still fire. The other 95 held up: 65 were accurate and useful, including findings that led the reviewer to discover five skills that had drifted outside version control entirely, and 30 were accurate and intentional — scheduled-task and subprocess-use findings that correctly required a human to confirm intent, exactly as designed.
Credential-Access Precision
Bare ".env" mentions in documentation prose no longer trigger a finding. Both credential-access detection paths require an access verb or call – cat, source, load_dotenv(, dotenv.config(, etc.
Shebang-Safe Script Scanning
The file-system-traversal check strips the interpreter shebang line before pattern matching, so an ordinary #!/usr/bin/env ... header no longer matches the bare /usr/ fragment.
Meta Tag Precision
Ordinary tags like <meta charset="UTF-8"> no longer flag as dangerous HTML. Only <meta http-equiv> – a genuine hidden-redirect/refresh vector – triggers a finding.
Context-Aware Exfiltration Detection
Bare "exfiltrate" / "siphon" / "smuggle" no longer fire on a skill’s own anti-exfiltration guidance; these verbs require object-and-destination context.
Persistence-Mechanism Boundary Fix
A negative lookbehind stops the .profile persistence check from matching inside ordinary property-access expressions such as resp.profile.
Dynamic-Execution Precision
The Function( obfuscation check no longer matches inside ordinary identifiers such as someFunction(x), and the Dynamic Code Execution finding populates its Evidence field.
Zero-Width Character Clustering
Hidden-content detection requires a cluster of 2+ consecutive zero-width characters, so a single zero-width joiner in a legitimate emoji sequence no longer fires.
Regression Coverage
The patch took the suite from 422 to 452 tests at the time, including 25 regression tests pairing each false positive with a genuine-intent counterpart that must still fire.
v2.4.0 – v2.5.0 – MCP spec currency, SkillJacking detection, Universal Skill Format (April–July 2026)
MCP 2026-07-28 Spec Currency
Flags servers still negotiating an older protocolVersion or reachable only over the deprecated legacy HTTP+SSE transport, tracking the biggest MCP specification revision since launch.
OAuth Advisory Disclosure
Discloses that the scanner’s behavioural auth probe confirms Bearer enforcement but cannot yet verify RFC 9207 issuer validation or the DCR→CIMD migration.
SkillJacking Detection
Detects skills referencing a GitHub dependency by a floating branch or unpinned git+https:// install URL instead of a pinned tag, release, or commit SHA – the account/repo hijacking vector behind 925 exposed skills.
Universal Skill Format: Risk Tier
SS-017 cross-checks a skill’s self-declared risk_tier against its actual observed capabilities. A "low" tier requesting unrestricted filesystem/network/shell access produces a High-severity finding.
Self-Contradiction Escalation
SS-028 escalates from High to Critical when a skill writes to an identity file it explicitly listed under its own deny_write declaration.
New Grade for Empty Scans
Scans with zero scannable surface (zero servers, zero skills) report Inconclusive instead of a misleading Grade A.
Identity/Memory File Write
Detects skills that write to agent identity or memory files (AGENTS.md, CLAUDE.md, MEMORY.md, SOUL.md) – the persistence technique behind the ClawHavoc campaign (1,184 malicious skills).
Orchestrator-Agnostic Scope
Declare which skills and MCP servers are live attack surface. Out-of-scope findings are tagged dormant and excluded from the grade, so it reflects real, reachable risk.
v2.3.0 – Suppressions, triage, non-MCP detection, counter-factual grading (April 2026)
Accepted-Risk Workflow
Accept specific findings with justification, approver, expiry, and per-environment scoping. Retained in every report for audit trail.
Confidence-Aware Triage
Hard filter below a confidence threshold, or demote medium-confidence findings one severity level with --triage.
Scan History & Diff
Attributes grade changes to the rules that caused them. "Your grade dropped from B to D because SS-022 fired."
Per-Environment Baselines
Separate baselines for dev / staging / prod so deltas do not leak between environments.
Non-MCP Endpoint Detection
When --remote targets a non-JSON-RPC endpoint, auto-suppresses all MCP-protocol rules for that target. No more misleading Grade A on a web front door.
YAML Capabilities Authority
The capabilities: block in a skill YAML frontmatter is authoritative for SS-012. Eliminates mechanical false positives.
Lemma-Aware Detection
Extended synonym table covers 30+ terms (disk, volume, mount, /proc, /sys, /dev) for operator-friendly language.
Counter-Factual Grade
"If these N suppressions were removed, your grade would be F (30/100) instead of A (100/100)." Suppressions cannot hide risk.
v2.2.0 – Rug-pull detection, SARIF, offline mode (March 2026)
Rug Pull Detection
Compare current scan against a saved baseline; flags schema mutations, additions, and removals as Critical / High / Medium. Protects against post-install tool swaps.
Shadow Tool Injection
Typosquat detection using Levenshtein distance against privileged tools and cross-server duplicates.
Skill Integrity
Detects skills that ship without .sentinel-sig, SHA256SUMS, or cosign.sig signature artefacts. Informational severity since v3.0.2; --policy strict pins it to High.
Excessive Response Size
Flags tool descriptions over 10 KB and JSON schemas nested more than 10 levels deep.
Offline Mode
Zero network-egress guarantee for air-gapped / HMG / defence environments. Refuses --remote and blocks outbound I/O.
SARIF v2.1.0 Output
OASIS-compliant SARIF output compatible with GitHub Code Scanning, Azure DevOps, and IDE extensions.
Sigma Rule Import
Load community Sigma YAML rules. Supports title/id/description/level/tags/logsource/detection subset.
Finding Deduplication
Collapses duplicate findings across sources with OccurrenceCount; rendered as [xN] annotation in reports.
49 security rules, triple OWASP mapping
42 detection rules and 7 informational rules, each mapped to Agentic AI Top 10 (ASI), Agentic Skills Top 10 (AST), and MCP Top 10. Every ASI and MCP category is claimed by at least one rule; eight of ten AST categories are. SS-026 and SS-036 apply to both the MCP and the skill surface and are listed once, under MCP.
The two open AST categories: AST09 No Governance describes an organisation's change-management and review process, which is not a property of a skill package and cannot be assessed from one. AST10 Cross-Platform Reuse has no shipped detection; it is specified but deliberately not built until there is enough real-world evidence to tune it without guessing.
MCP Top 10 codes follow the scanner's own mapping, so the column matches what appears in its reports; rules with no MCP counterpart are left blank.
MCP Server Rules
| Rule | ASI | AST | MCP | Description |
|---|---|---|---|---|
| SS-001 | ASI01 | AST01, AST04 | MCP01 | Tool Poisoning Detection |
| SS-002 | ASI02 | AST03 | MCP02 | Overbroad Permissions Detection |
| SS-003 | ASI03 | AST06 | MCP07 | Missing Authentication Detection |
| SS-004 | ASI04 | AST02 | MCP03 | Supply Chain Vulnerability Detection |
| SS-005 | ASI05 | AST01, AST06 | MCP08 | Code Execution Capability Detection |
| SS-006 | ASI06 | AST06 | MCP05 | Memory / Context Write Access Detection |
| SS-007 | ASI07 | AST01 | MCP09 | Inter-Agent Communication Detection |
| SS-008 | ASI09 | AST04 | MCP05 | Sensitive Data Access Detection |
| SS-009 | ASI01 | AST04 | MCP01 | Excessive Description Length |
| SS-010 | ASI02 | AST01, AST03 | MCP02 | Cross-Server Attack Path Analysis |
| SS-019 | ASI03 | AST01, AST04 | MCP07 | Credential Hygiene Check |
| SS-020 | ASI03 | AST06 | MCP07 | OAuth 2.1 Compliance Check (advisory for RFC 9207 / DCR→CIMD) |
| SS-021 | ASI04 | AST02, AST07 | MCP03 | Package Provenance Check |
| SS-022 | ASI01 | AST01, AST02 | Rug Pull / Schema Mutation Detection | |
| SS-023 | ASI01 | AST01 | Shadow Tool Injection (typosquat) | |
| SS-025 | ASI06 | AST03 | Excessive Tool Response Size | |
| SS-026 | ASI01 | AST04 | Instructional Tool/Skill Description (hidden agent-directed instructions; skill side is frontmatter-only since v3.0) | |
| SS-030 | ASI01 | AST04 | MCP01 | MCP Prompt Poisoning (v3.0) |
| SS-031 | ASI01 | AST04 | MCP06 | MCP Resource Poisoning, including resources that advertise credential material (v3.0) |
| SS-032 | ASI01 | AST04, AST05 | MCP01 | MCP Server Instructions Injection (v3.0) |
| SS-033 | ASI07 | AST08 | MCP03 | Unsolicited Server-to-Client Request (v3.0) |
| SS-036 | ASI01 | AST04 | MCP03 | Unicode Confusable Identifier across tool, prompt, resource, server and skill names (v3.0) |
| SS-040 | ASI01 | AST04 | MCP01 | Error-Channel / Result-Channel Injection (v3.0) |
Agent Skill Rules
| Rule | ASI | AST | Description |
|---|---|---|---|
| SS-011 | ASI01 | AST01, AST04, AST05 | Skill Prompt Injection Detection |
| SS-012 | ASI02 | AST03 | Skill Scope Violation Detection (verb-shaped capability matching since v3.0.2) |
| SS-013 | ASI03 | AST01 | Skill Credential Access Detection |
| SS-014 | ASI09 | AST01, AST03 | Skill Data Exfiltration Detection |
| SS-015 | ASI01 | AST04 | Skill Obfuscation Detection |
| SS-016 | ASI05 | AST01, AST06 | Skill Script Payload Detection |
| SS-017 | ASI02 | AST03 | Skill Excessive Permissions Detection (Universal Skill Format risk_tier cross-check) |
| SS-018 | ASI01 | AST04 | Skill Hidden Content Detection |
| SS-024 | ASI04 | AST02, AST07 | Skill Integrity Verification (Informational severity since v3.0.2; --policy strict pins it to High) |
| SS-028 | ASI02 | AST03 | Skill Identity/Memory File Write Access (ClawHavoc persistence pattern) |
| SS-029 | ASI04 | AST02, AST07 | Skill Unpinned Dependency Reference (SkillJacking) |
| SS-034 | ASI04 | AST02, AST07 | Skill Integrity Mismatch – SHA256SUMS and signature verification (v3.0) |
| SS-035 | ASI04 | AST01, AST06 | Suspicious File Artefact – magic-byte forensics for hidden binaries, archives and double extensions (v3.0) |
| SS-037 | ASI01 | AST04 | Cross-Skill Description Overlap – trigger shadowing between skills (v3.0) |
| SS-038 | ASI05 | AST01, AST06 | Skill Script Pipeline Taint – fetch-to-exec flows, direct and base64-encoded (v3.0) |
| SS-039 | ASI04 | AST02, AST07 | Skill Dependency Known Vulnerability – OSV lookup of pinned dependencies, requires --osv (v3.0) |
| SS-043 | ASI01 | AST04 | Dangerous Construct in Shipped Skill Metadata – code-executing YAML tags, prototype-pollution keys, duplicate-key ambiguity in .yaml/.json/.toml sidecars (v3.1) |
Static Surface Rules (v3.0)
| Rule | ASI | AST | Description |
|---|---|---|---|
| SS-041 | ASI05 | AST06 | Server Source Dangerous Sink – static analysis of MCP server JavaScript, TypeScript or Python (requires --server-source <dir>) |
| SS-042 | ASI01 | AST04 | A2A Agent Card Findings – undeclared authentication and injection in advertised capabilities (requires --agent-card <url|path>) |
Informational
| Rule | OWASP | Description |
|---|---|---|
| SS-INFO-001 | ASI10 | Non-MCP Endpoint Detected – emitted when the target returns non-JSON-RPC content. Auto-suppresses all MCP-protocol rules for that target. |
| SS-INFO-002 | ASI03 | Non-Public Scan Target – flags loopback, RFC 1918, link-local, or non-public-hostname targets and exempts transport-posture rules that only make sense against a public endpoint. |
| SS-INFO-003 | ASI10 | Untrusted Server Certificate – distinguishes a TLS trust-chain failure from a generic connectivity error. |
| SS-INFO-004 | ASI04 | Legacy MCP Protocol / Transport – flags a protocolVersion older than the MCP 2026-07-28 specification, or the deprecated legacy HTTP+SSE transport. A currency notice, not a vulnerability. |
| SS-INFO-005 | ASI02 | MCP Capability Surface – per-server record of what was actually exposed: listChanged, experimental and completions capabilities (v3.0). |
| SS-INFO-006 | ASI04 | Skill Dependency Surface (Unchecked) – lists pinned dependencies that were not checked because --osv was absent, offline or failed (v3.0). |
| SS-INFO-007 | ASI10 | MCP Logging Capability Absent – the server does not advertise the MCP logging capability, so its operations cannot be audited through the protocol. Says nothing about logs the server may keep itself (v3.1). |
Native SARIF v2.1.0 output
SARIF is the OASIS standard for static analysis results. Signal Sentinel emits SARIF v2.1.0 alongside JSON, Markdown, and HTML, so you can pipe scan results into GitHub Code Scanning, Azure DevOps Advanced Security, Defender for Cloud, JetBrains Qodana, and any other SARIF-compatible tool without a converter.
Air-gapped by design
Pass --offline and Signal Sentinel refuses to make any network call for the duration of the scan. Remote MCP targets are rejected, DNS lookups are disabled, the OSV dependency lookup is refused, and the runtime blocks outbound I/O. All detection logic runs from the local binary against local files. No telemetry, no callbacks, no model dependency. The --policy defence preset implies it. Suitable for OFFICIAL-SENSITIVE / SECRET environments subject to JSP 440 / 656.
Clear, actionable security grades
Scoring: -25 critical, -10 high, -3 medium, -1 low. Attack paths: -20 critical, -10 high. A single critical vulnerability appropriately dominates the score.
Since v3.0 these weights live in a versioned, auditable rubric (v2.0.0, reported in every scan) that an organisation can override with --rubric. Scans with nothing assessed report Inconclusive rather than a misleading Grade A, and since v3.0.2 a grade can never read better than the score band it is derived from.
Get started in 60 seconds
Available as a .NET global tool, Docker image, or build from source. Windows, macOS, and Linux.
# Install (requires .NET 10 SDK)
dotnet tool install -g SignalSentinel.Scanner
# Verify
sentinel-scan --version
# Signal Sentinel Scanner v3.1.0
# Update
dotnet tool update -g SignalSentinel.ScannerQuick scan:
Command reference:
| Option | Short | Description |
|---|---|---|
| --config <path> | -c | Path to MCP configuration file |
| --remote <url> | -r | Remote MCP server URL (http/https/ws/wss) |
| --discover | -d | Auto-discover MCP configurations |
| --skills [path] | -s | Scan Agent Skills (auto-discover or specify path) |
| --server-source <dir> | Static analysis of MCP server source (JS/TS/Python) - v3.0 | |
| --agent-card <url|path> | Evaluate an A2A Agent Card - v3.0 | |
| --policy <preset|file> | default, strict, defence, or a JSON policy file - v3.0 | |
| --rubric <path> | Substitute a custom scoring rubric (invalid rubrics fail closed) - v3.0 | |
| --allow-private | Permit --remote against loopback / RFC1918 / link-local targets - v3.0 | |
| --osv | Look up pinned skill dependencies in the OSV database (refused with --offline) - v3.0 | |
| --format <fmt> | -f | Output format: json, markdown, html, sarif |
| --output <path> | -o | Output file path (default: stdout) |
| --ci | CI mode - exit code 1 on critical/high | |
| --offline | Air-gapped mode - zero network egress | |
| --baseline <path> | Baseline file for rug-pull detection | |
| --update-baseline | Save current scan as new baseline | |
| --environment <name> | Environment name for per-env baselines | |
| --suppressions <path> | Suppression file for accepted risks | |
| --scope <path> | Orchestrator-agnostic scope file (.sentinel-scope.json) | |
| --include-skills <list> | Skills to treat as in-scope (overrides --scope) | |
| --exclude-skills <list> | Skills to treat as dormant (overrides --scope) | |
| --min-confidence <n> | Filter findings below confidence threshold | |
| --triage | Demote medium-confidence findings one severity level | |
| --verbose | -v | Enable verbose output |
| --timeout <sec> | -t | Connection timeout (default: 30, max: 300) |
| diff <a> <b> | Compare two scan results and attribute grade changes |
Auto-discovers across your AI tools
MCP Configuration Discovery
User-level and project-level config shapes, including .mcp.json, .vscode/mcp.json and .cursor/mcp.json. Entries marked enabled: false are skipped.
Agent Skill Discovery
Also walks the Claude plugin cache and parses Claude Code hook configurations as a scan surface.
All MCP transports supported: stdio (local), HTTP/SSE (remote), Streamable HTTP, and WebSocket (ws/wss).
Integrate into your pipeline
In CI mode (--ci flag), the scanner returns exit code 1 when critical or high severity findings are detected. Exit code 0 = clean, 1 = findings detected, 2 = scan failed or arguments/policy rejected.
name: MCP Security Scan
on: [push, pull_request]
jobs:
sentinel:
runs-on: ubuntu-latest
permissions:
contents: read
security-events: write
steps:
- uses: actions/checkout@v4
- name: Scan
run: |
docker run --rm -v ${{ github.workspace }}:/src \
ghcr.io/signalcoding/signal-sentinel-scanner:3.1.0 \
--discover --skills /src --ci --format sarif -o /src/sentinel.sarif
- name: Upload SARIF
uses: github/codeql-action/upload-sarif@v3
with:
sarif_file: sentinel.sarifPurpose-built for MCP and Agent Skills
| Feature | Signal Sentinel | Invariant MCP Scan | Pillar MCP Audit |
|---|---|---|---|
| Security Rules | 49 (42 detection + 7 informational) | ~5 | ~3 |
| Scan Surfaces | MCP servers, Agent Skills, server source, A2A cards | MCP servers | MCP servers |
| OWASP ASI Mapping | Full (ASI01-ASI10) | Partial | None |
| OWASP AST Mapping | 8 of 10 (AST09, AST10 documented open) | None | None |
| OWASP MCP Mapping | Full (MCP01-MCP10) | None | None |
| SkillJacking Detection | Yes | No | No |
| Policy Presets | default / strict / defence | No | No |
| SARIF Output | v2.1.0 | No | No |
| Offline / Air-gapped | Yes | No | No |
| Suppression Workflow | Yes | No | No |
| Rug-Pull Detection | Yes | No | No |
| Attack Path Analysis | Yes | No | No |
| Bundled Script Analysis | .py, .sh, .ps1, .js, .ts and more | No | No |
| Auto-Discovery (MCP) | 10 platforms | 2 platforms | 1 platform |
| Auto-Discovery (Skills) | 8 platforms + generic dirs | None | None |
| WebSocket Transport | Yes | No | No |
| Open Source | Apache 2.0 | Partial | No |
| Docker (Multi-arch) | Yes | Single arch | None |
Technical details
| Version | 3.1.0 |
| Runtime | .NET 10 LTS |
| Language | C# 14 |
| Security Rules | 49 total (42 detection + 7 informational), every finding mapped to all three OWASP frameworks |
| OWASP Coverage | ASI 10 of 10, MCP 10 of 10, AST 8 of 10 (AST09 and AST10 documented open) |
| Scan Surfaces | MCP servers, Agent Skills, MCP server source code, A2A Agent Cards |
| OWASP Frameworks | Agentic AI Top 10 + Agentic Skills Top 10 + MCP Top 10 |
| MCP Spec Currency | Tracks the 2026-07-28 specification revision (SS-INFO-004) |
| Transports | stdio, HTTP/SSE, Streamable HTTP, WebSocket |
| Policy Presets | default, strict, defence, or a JSON policy file |
| Scoring Rubric | v2.0.0, embedded and versioned; overridable with --rubric |
| Licence | Apache 2.0 |
| Unit Tests | 1,831 (all passing) |
| Typical scan time | 1-5 seconds |
| Platforms | Windows, macOS, Linux |
| Distribution | .NET Tool (NuGet), Docker (GHCR, multi-architecture), Source |
| Docker image | Alpine Linux, ~50MB, non-root, amd64/arm64 |
| Output formats | JSON, Markdown, HTML, SARIF v2.1.0 |
| Build quality | 0 warnings, 0 errors (warnings-as-errors enabled) |
| Published | 27 September 2026 |
Frequently asked questions
What is MCP?
The Model Context Protocol is an open standard created by Anthropic for connecting AI assistants to external tools and data sources. Adopted by OpenAI, Google, Microsoft, and the broader AI ecosystem.
What are Agent Skills?
Agent Skills are SKILL.md files that define reusable instructions, capabilities, and bundled scripts for AI coding assistants. Adopted by Claude Code, Codex CLI, Cursor, Windsurf, and 20+ platforms. They are a growing attack surface for prompt injection and supply chain attacks.
What are the four scan surfaces?
MCP servers (configuration files and live servers over any transport), Agent Skills (SKILL.md files and bundled scripts), MCP server source code (static analysis of a server’s own JavaScript, TypeScript or Python via --server-source), and A2A Agent Cards (Agent2Agent capability declarations via --agent-card). The last two were added in v3.0.0.
Why scan Agent Skills?
Community skill marketplaces host thousands of skills, and documented large-scale supply chain attacks have already been observed. A malicious skill can inject prompts, exfiltrate data, execute arbitrary code, and persist across sessions - all while appearing benign.
What is SkillJacking?
SkillJacking is a supply-chain attack where a skill references a GitHub dependency by a floating branch or unpinned install URL. If the upstream account or repository is later deleted and re-registered by an attacker, every installation silently pulls malicious code. Air Security’s July 2026 research documented 925 exposed skills reaching an estimated 134,000 agents. SS-029 detects this pattern.
What do the policy presets do?
default applies the standard severities. strict raises supply-chain rules one severity band and fails CI at Medium. defence raises every rule one band, fails at Low and implies --offline. A JSON policy file allows per-rule severity overrides, rule disabling and custom gate thresholds, so the policy is version-controlled alongside the code it governs.
What is SARIF?
SARIF (Static Analysis Results Interchange Format) is an OASIS standard for expressing static analysis results. Signal Sentinel emits SARIF v2.1.0 so you can upload results directly to GitHub Code Scanning, Azure DevOps, Defender for Cloud, or any SARIF-compatible tool.
Can it run in air-gapped environments?
Yes. Pass --offline and the scanner refuses all network calls, DNS lookups, OSV lookups and outbound I/O. All detection runs from the local binary against local files. No telemetry, no callbacks, no model dependency.
What is the suppression workflow?
Create a .sentinel-suppressions.json file to accept specific findings with a justification, approver, expiry date, and per-environment scoping. Suppressed findings are retained in every report for audit trail. Counter-factual grading shows what your grade would be without suppressions.
Is Signal Sentinel free?
Yes. Free and open-source under Apache 2.0. No telemetry, no data collection, no registration required.
Does it send data anywhere?
No. Signal Sentinel runs entirely locally. The only network connections are to MCP servers or agent cards you explicitly ask it to scan, and the OSV database if you opt in with --osv. All of these are disabled in --offline mode.
What transports are supported?
All four MCP transports: stdio (local processes), HTTP/SSE, Streamable HTTP, and WebSocket (ws/wss).
Can I use it in CI/CD?
Yes. Use --ci flag for exit code 1 on critical/high findings, and --format sarif for GitHub Code Scanning upload. Argument and policy errors exit 2, so a misconfigured pipeline step fails rather than passing silently. Works with GitHub Actions, Azure DevOps, GitLab CI, Jenkins, and any CI system that runs .NET or Docker. Pre-commit hooks available for pre-commit.com, lefthook, and husky.
What .NET version is required?
.NET 10 SDK or later for the .NET global tool. Docker requires no .NET installation.
How do I report a security issue?
Email security@signalcoding.co.uk. Do not open a public GitHub issue for security vulnerabilities.
What comes next?
Signal Sentinel Gateway (real-time MCP firewall) and Signal Sentinel Classify (document classification MCP server) are in development. See our product roadmap for details.
Secure your AI agent integrations today
49 security rules. Four scan surfaces. Triple OWASP mapping. SARIF, offline mode, policy presets, suppressions, triage, and counter-factual grading. Free, open source, and runs in seconds.
Last updated: September 2026