Secure your AI agents. Scan MCP servers and Agent Skills before attackers do.
32 security rules aligned with OWASP Agentic AI Top 10, OWASP Agentic Skills Top 10, and OWASP MCP Top 10. Free and open source. Built on .NET 10 with defence-grade governance.
Signal Sentinel Scanner is a fast, deterministic, offline-capable first-pass authoring aid for MCP operators and skill authors. Pair it with Bandit, Gitleaks, Semgrep, and Sentinel Gateway for defence in depth.
_
Two attack surfaces. One scanner.
Signal Sentinel Scanner performs static and runtime security analysis of both MCP server configurations and Agent Skill packages.
MCP Server Scanning
Scans local config files (Claude Desktop, Cursor, VS Code, Windsurf, Zed) and connects to remote MCP servers (HTTP/SSE, Streamable HTTP, WebSocket) to enumerate tools, resources, and prompts for security vulnerabilities.
Agent Skill Scanning
Scans SKILL.md files (the emerging standard adopted by Claude Code, Codex CLI, Cursor, Windsurf, and 20+ platforms) for prompt injection, credential exposure, data exfiltration, obfuscated payloads, unpinned supply-chain dependencies, and malicious bundled scripts.
Every finding is mapped to the OWASP Agentic AI Security Top 10 (ASI01-ASI10), the OWASP Agentic Skills Top 10 (AST01-AST10), and the OWASP MCP Top 10 (MCP01-MCP10) — 100% coverageacross all three frameworks — producing a scored A-F (or Inconclusive) grade with prioritised remediation guidance.
What's new
Recent releases since v2.1.0
v2.2.0 – Rug-pull detection, SARIF, offline mode (March 2026)
Rug Pull Detection
Compare current scan against a saved baseline; flags schema mutations, additions, and removals as Critical / High / Medium. Protects against post-install tool swaps.
Shadow Tool Injection
Typosquat detection using Levenshtein distance against privileged tools and cross-server duplicates.
Skill Integrity
Detects skills that ship without .sentinel-sig, SHA256SUMS, or cosign.sig signature artefacts.
Excessive Response Size
Flags tool descriptions over 10 KB and JSON schemas nested more than 10 levels deep.
Offline Mode
Zero network-egress guarantee for air-gapped / HMG / defence environments. Refuses --remote and blocks outbound I/O.
SARIF v2.1.0 Output
OASIS-compliant SARIF output compatible with GitHub Code Scanning, Azure DevOps, and IDE extensions.
Sigma Rule Import
Load community Sigma YAML rules. Supports title/id/description/level/tags/logsource/detection subset.
Finding Deduplication
Collapses duplicate findings across sources with OccurrenceCount; rendered as [xN] annotation in reports.
v2.3.0 – Suppressions, triage, non-MCP detection, counter-factual grading (April 2026)
Accepted-Risk Workflow
Accept specific findings with justification, approver, expiry, and per-environment scoping. Retained in every report for audit trail.
Confidence-Aware Triage
Hard filter below a confidence threshold, or demote medium-confidence findings one severity level with --triage.
Scan History & Diff
Attributes grade changes to the rules that caused them. "Your grade dropped from B to D because SS-022 fired."
Per-Environment Baselines
Separate baselines for dev / staging / prod so deltas do not leak between environments.
Non-MCP Endpoint Detection
When --remote targets a non-JSON-RPC endpoint, auto-suppresses all MCP-protocol rules for that target. No more misleading Grade A on a web front door.
YAML Capabilities Authority
The capabilities: block in a skill YAML frontmatter is authoritative for SS-012. Eliminates mechanical false positives.
Lemma-Aware Detection
Extended synonym table covers 30+ terms (disk, volume, mount, /proc, /sys, /dev) for operator-friendly language.
Counter-Factual Grade
"If these N suppressions were removed, your grade would be F (30/100) instead of A (100/100)." Suppressions cannot hide risk.
v2.4.0 – v2.5.0 – MCP spec currency, SkillJacking detection, Universal Skill Format (April–July 2026)
MCP 2026-07-28 Spec Currency
Flags servers still negotiating an older protocolVersion or reachable only over the deprecated legacy HTTP+SSE transport, tracking the biggest MCP specification revision since launch.
OAuth Advisory Disclosure
Discloses that the scanner’s behavioural auth probe confirms Bearer enforcement but cannot yet verify RFC 9207 issuer validation or the DCR→CIMD migration.
SkillJacking Detection
Detects skills referencing a GitHub dependency by a floating branch or unpinned git+https:// install URL instead of a pinned tag, release, or commit SHA – the account/repo hijacking vector behind 925 exposed skills.
Universal Skill Format: Risk Tier
SS-017 cross-checks a skill’s self-declared risk_tier against its actual observed capabilities. A "low" tier requesting unrestricted filesystem/network/shell access now produces a High-severity finding.
Self-Contradiction Escalation
SS-028 escalates from High to Critical when a skill writes to an identity file it explicitly listed under its own deny_write declaration.
New Grade for Empty Scans
Scans with zero scannable surface (zero servers, zero skills) now report Inconclusive instead of a misleading Grade A.
Identity/Memory File Write
Detects skills that write to agent identity or memory files (AGENTS.md, CLAUDE.md, MEMORY.md, SOUL.md) – the persistence technique behind the ClawHavoc campaign (1,184 malicious skills).
Orchestrator-Agnostic Scope
Declare which skills and MCP servers are live attack surface. Out-of-scope findings are tagged dormant and excluded from the grade, so it reflects real, reachable risk.
v2.5.1 – Skill-scanner false-positive remediation (August 2026)
A real-world reviewer ran the scanner offline against 65 production Claude Skills. The initial result looked bad — Grade F, 584 findings, 84 Critical — but manual review told a more useful story. 489 were false positives, all traced to the same seven rule bugs below and fixed with regression tests for both the false positive and a genuine-intent counterpart that must still fire. The other 95 held up: 65 were accurate and useful, including findings that led the reviewer to discover five skills that had drifted outside version control entirely, and 30 were accurate and intentional — scheduled-task and subprocess-use findings that correctly required a human to confirm intent, exactly as designed.
Credential-Access Precision
Bare ".env" mentions in documentation prose ("store your key in a .env file") no longer trigger a finding. Both credential-access detection paths now require an access verb or call – cat, source, load_dotenv(, dotenv.config(, etc. Fixed 52 of 56 credential-access findings in the review.
Shebang-Safe Script Scanning
The file-system-traversal check now strips the interpreter shebang line before pattern matching, so an ordinary #!/usr/bin/env ... header no longer matches the bare /usr/ fragment. Fixed 170 of 240 script-payload findings in the review.
Meta Tag Precision
Ordinary tags like <meta charset="UTF-8"> no longer flag as dangerous HTML. Only <meta http-equiv> – a genuine hidden-redirect/refresh vector – triggers a finding, via its own dedicated check.
Context-Aware Exfiltration Detection
Bare "exfiltrate" / "siphon" / "smuggle" no longer fire on a skill’s own anti-exfiltration guidance. These verbs now require the same object-and-destination-gated context as every other outbound verb in the pattern.
Persistence-Mechanism Boundary Fix
A negative lookbehind now stops the .profile persistence check from matching inside ordinary property-access expressions such as resp.profile.
Dynamic-Execution Precision
The Function( obfuscation check no longer matches inside ordinary identifiers such as someFunction(x). The related Dynamic Code Execution finding also now correctly populates its Evidence field, which it previously left blank.
Zero-Width Character Clustering
Hidden-content detection now requires a cluster of 2+ consecutive zero-width characters, matching the threshold already used for obfuscation detection, so a single zero-width joiner in a legitimate emoji sequence no longer fires.
All fixes are regex/logic tightenings against existing rules — no rules were removed and no detection capability for real attack patterns was given up. 452 tests passing (up from 422), including 25 new regression tests, with 0 warnings and 0 errors.
32 security rules: 100% OWASP coverage
17 MCP server rules, 11 Agent Skill rules, and 4 informational rules. Triple OWASP mapping: Agentic AI Top 10 (ASI), Agentic Skills Top 10 (AST), and MCP Top 10.
MCP Server Rules (17)
| Rule | ASI | AST | MCP | Description |
|---|---|---|---|---|
| SS-001 | ASI01 | AST01, AST04 | MCP01 | Tool Poisoning Detection |
| SS-002 | ASI02 | AST03 | MCP02 | Overbroad Permissions Detection |
| SS-003 | ASI03 | AST06 | MCP03 | Missing Authentication Detection |
| SS-004 | ASI04 | AST02 | MCP04 | Supply Chain Vulnerability Detection |
| SS-005 | ASI05 | AST01, AST06 | MCP05 | Code Execution Capability Detection |
| SS-006 | ASI06 | AST06 | MCP06 | Memory / Context Write Access Detection |
| SS-007 | ASI07 | AST01 | MCP07 | Inter-Agent Communication Detection |
| SS-008 | ASI09 | AST04 | MCP08 | Sensitive Data Access Detection |
| SS-009 | ASI01 | AST04 | MCP09 | Excessive Description Length |
| SS-010 | ASI02 | AST01, AST03 | MCP10 | Cross-Server Attack Path Analysis |
| SS-019 | ASI03 | AST01, AST04 | MCP03 | Credential Hygiene Check |
| SS-020 | ASI03 | AST06 | MCP03 | OAuth 2.1 Compliance Check (v2.5: advisory for RFC 9207 / DCR→CIMD) |
| SS-021 | ASI04 | AST02, AST07 | MCP04 | Package Provenance Check |
| SS-022 | ASI01 | AST01, AST02 | MCP01 | Rug Pull / Schema Mutation Detection |
| SS-023 | ASI01 | AST01 | MCP01 | Shadow Tool Injection (typosquat) |
| SS-025 | ASI06 | AST03 | MCP06 | Excessive Tool Response Size |
| SS-026 | ASI01 | AST04 | MCP01 | Instructional Tool/Skill Description (hidden agent-directed instructions) |
Agent Skill Rules (11)
| Rule | ASI | AST | Description |
|---|---|---|---|
| SS-011 | ASI01 | AST01, AST04, AST05 | Skill Prompt Injection Detection |
| SS-012 | ASI02 | AST03 | Skill Scope Violation Detection |
| SS-013 | ASI03 | AST01 | Skill Credential Access Detection |
| SS-014 | ASI09 | AST01, AST03 | Skill Data Exfiltration Detection |
| SS-015 | ASI01 | AST04 | Skill Obfuscation Detection |
| SS-016 | ASI05 | AST01, AST06 | Skill Script Payload Detection |
| SS-017 | ASI02 | AST03 | Skill Excessive Permissions Detection (Universal Skill Format risk_tier cross-check) |
| SS-018 | ASI01 | AST04 | Skill Hidden Content Detection |
| SS-024 | ASI04 | AST02, AST07 | Skill Integrity Verification |
| SS-028 | ASI02 | AST03 | Skill Identity/Memory File Write Access (ClawHavoc persistence pattern) |
| SS-029 | ASI04 | AST02, AST07 | Skill Unpinned Dependency Reference (SkillJacking) |
Informational (4)
| Rule | OWASP | Description |
|---|---|---|
| SS-INFO-001 | ASI10 | Non-MCP Endpoint Detected – emitted when the target returns non-JSON-RPC content. Auto-suppresses all MCP-protocol rules for that target. |
| SS-INFO-002 | ASI03 | Non-Public Scan Target – flags loopback, RFC 1918, link-local, or non-public-hostname targets and exempts transport-posture rules that only make sense against a public endpoint. |
| SS-INFO-003 | ASI10 | Untrusted Server Certificate – distinguishes a TLS trust-chain failure from a generic connectivity error. |
| SS-INFO-004 | ASI04 | Legacy MCP Protocol / Transport – flags a protocolVersion older than the MCP 2026-07-28 specification, or the deprecated legacy HTTP+SSE transport. A currency notice, not a vulnerability. |
Native SARIF v2.1.0 output
SARIF is the OASIS standard for static analysis results. Signal Sentinel emits SARIF v2.1.0 alongside JSON, Markdown, and HTML, so you can pipe scan results into GitHub Code Scanning, Azure DevOps Advanced Security, Defender for Cloud, JetBrains Qodana, and any other SARIF-compatible tool without a converter.
Air-gapped by design
Pass --offline and Signal Sentinel refuses to make any network call for the duration of the scan. Remote MCP targets are rejected, DNS lookups are disabled, and the runtime blocks outbound I/O. All detection logic runs from the local binary against local files. No telemetry, no callbacks, no model dependency. Suitable for OFFICIAL-SENSITIVE / SECRET environments subject to JSP 440 / 656.
Clear, actionable security grades
Scoring: -25 critical, -10 high, -3 medium, -1 low. Attack paths: -20 critical, -10 high. A single critical vulnerability appropriately dominates the score.
New in v2.4.1: scans with zero scannable surface (zero servers, zero skills) report Inconclusive instead of a misleading Grade A.
Get started in 60 seconds
Available as a .NET global tool, Docker image, or build from source. Windows, macOS, and Linux.
# Install (requires .NET 10 SDK)
dotnet tool install -g SignalSentinel.Scanner
# Verify
sentinel-scan --version
# Signal Sentinel Scanner v2.5.1
# Update
dotnet tool update -g SignalSentinel.ScannerQuick scan:
Command reference:
| Option | Short | Description |
|---|---|---|
| --config <path> | -c | Path to MCP configuration file |
| --remote <url> | -r | Remote MCP server URL (http/https/ws/wss) |
| --discover | -d | Auto-discover MCP configurations |
| --skills [path] | -s | Scan Agent Skills (auto-discover or specify path) |
| --format <fmt> | -f | Output format: json, markdown, html, sarif |
| --output <path> | -o | Output file path (default: stdout) |
| --ci | CI mode - exit code 1 on critical/high | |
| --offline | Air-gapped mode - zero network egress | |
| --baseline <path> | Baseline file for rug-pull detection | |
| --update-baseline | Save current scan as new baseline | |
| --environment <name> | Environment name for per-env baselines | |
| --suppressions <path> | Suppression file for accepted risks | |
| --scope <path> | Orchestrator-agnostic scope file (.sentinel-scope.json) | |
| --include-skills <list> | Skills to treat as in-scope (overrides --scope) | |
| --exclude-skills <list> | Skills to treat as dormant (overrides --scope) | |
| --min-confidence <n> | Filter findings below confidence threshold | |
| --triage | Demote medium-confidence findings one severity level | |
| --verbose | -v | Enable verbose output |
| --timeout <sec> | -t | Connection timeout (default: 30, max: 300) |
| diff <a> <b> | Compare two scan results and attribute grade changes |
Auto-discovers across your AI tools
MCP Configuration Discovery
Agent Skill Discovery
All MCP transports supported: stdio (local), HTTP/SSE (remote), Streamable HTTP, and WebSocket (ws/wss).
Integrate into your pipeline
In CI mode (--ci flag), the scanner returns exit code 1 when critical or high severity findings are detected. Exit code 0 = clean, 1 = findings detected, 2 = scan failed.
name: MCP Security Scan
on: [push, pull_request]
jobs:
sentinel:
runs-on: ubuntu-latest
permissions:
contents: read
security-events: write
steps:
- uses: actions/checkout@v4
- name: Scan
run: |
docker run --rm -v ${{ github.workspace }}:/src \
ghcr.io/signalcoding/signal-sentinel-scanner:2.5.1 \
--discover --skills /src --ci --format sarif -o /src/sentinel.sarif
- name: Upload SARIF
uses: github/codeql-action/upload-sarif@v3
with:
sarif_file: sentinel.sarifPurpose-built for MCP and Agent Skills
| Feature | Signal Sentinel | Invariant MCP Scan | Pillar MCP Audit |
|---|---|---|---|
| MCP Server Scanning | 17 rules | 5 rules | 3 rules |
| Agent Skill Scanning | 11 rules | None | None |
| OWASP ASI Mapping | Full (ASI01-ASI10) | Partial | None |
| OWASP AST Mapping | Full (AST01-AST10) | None | None |
| OWASP MCP Mapping | Full (MCP01-MCP10) | None | None |
| SkillJacking Detection | Yes | No | No |
| SARIF Output | v2.1.0 | No | No |
| Offline / Air-gapped | Yes | No | No |
| Suppression Workflow | Yes | No | No |
| Rug-Pull Detection | Yes | No | No |
| Attack Path Analysis | Yes | No | No |
| Bundled Script Analysis | .py, .sh, .ps1, .js, .ts | No | No |
| Auto-Discovery (MCP) | 5 platforms | 2 platforms | 1 platform |
| Auto-Discovery (Skills) | 5 platforms | None | None |
| WebSocket Transport | Yes | No | No |
| Open Source | Apache 2.0 | Partial | No |
| Docker (Multi-arch) | Yes | Single arch | None |
Technical details
| Version | 2.5.1 |
| Runtime | .NET 10 LTS |
| Language | C# 14 |
| Security Rules | 32 total, 100% OWASP coverage (17 MCP + 11 Skill + 4 Info) |
| OWASP Frameworks | Agentic AI Top 10 + Agentic Skills Top 10 + MCP Top 10 |
| MCP Spec Currency | Tracks the 2026-07-28 specification revision (SS-INFO-004) |
| Transports | stdio, HTTP/SSE, Streamable HTTP, WebSocket |
| Licence | Apache 2.0 |
| Unit Tests | 452 (all passing) |
| Typical scan time | 1-5 seconds |
| Platforms | Windows, macOS, Linux |
| Distribution | .NET Tool (NuGet), Docker (GHCR), Source |
| Docker image | Alpine Linux, ~50MB, non-root, amd64/arm64 |
| Output formats | JSON, Markdown, HTML, SARIF v2.1.0 |
| Build quality | 0 warnings, 0 errors (warnings-as-errors enabled) |
| Published | 11 August 2026 |
Frequently asked questions
What is MCP?
The Model Context Protocol is an open standard created by Anthropic for connecting AI assistants to external tools and data sources. Adopted by OpenAI, Google, Microsoft, and the broader AI ecosystem.
What are Agent Skills?
Agent Skills are SKILL.md files that define reusable instructions, capabilities, and bundled scripts for AI coding assistants. Adopted by Claude Code, Codex CLI, Cursor, Windsurf, and 20+ platforms. They are a growing attack surface for prompt injection and supply chain attacks.
Why scan Agent Skills?
Community skill marketplaces host thousands of skills, and documented large-scale supply chain attacks have already been observed. A malicious skill can inject prompts, exfiltrate data, execute arbitrary code, and persist across sessions - all while appearing benign.
What is SkillJacking?
SkillJacking is a supply-chain attack where a skill references a GitHub dependency by a floating branch or unpinned install URL. If the upstream account or repository is later deleted and re-registered by an attacker, every installation silently pulls malicious code. Air Security’s July 2026 research documented 925 exposed skills reaching an estimated 134,000 agents. SS-029 detects this pattern.
What is SARIF?
SARIF (Static Analysis Results Interchange Format) is an OASIS standard for expressing static analysis results. Signal Sentinel emits SARIF v2.1.0 so you can upload results directly to GitHub Code Scanning, Azure DevOps, Defender for Cloud, or any SARIF-compatible tool.
Can it run in air-gapped environments?
Yes. Pass --offline and the scanner refuses all network calls, DNS lookups, and outbound I/O. All detection runs from the local binary against local files. No telemetry, no callbacks, no model dependency.
What is the suppression workflow?
Create a .sentinel-suppressions.json file to accept specific findings with a justification, approver, expiry date, and per-environment scoping. Suppressed findings are retained in every report for audit trail. Counter-factual grading shows what your grade would be without suppressions.
Is Signal Sentinel free?
Yes. Free and open-source under Apache 2.0. No telemetry, no data collection, no registration required.
Does it send data anywhere?
No. Signal Sentinel runs entirely locally. The only network connections are to MCP servers you explicitly ask it to scan (disabled in --offline mode).
What transports are supported?
All four MCP transports: stdio (local processes), HTTP/SSE, Streamable HTTP, and WebSocket (ws/wss).
Can I use it in CI/CD?
Yes. Use --ci flag for exit code 1 on critical/high findings, and --format sarif for GitHub Code Scanning upload. Works with GitHub Actions, Azure DevOps, GitLab CI, Jenkins, and any CI system that runs .NET or Docker. Pre-commit hooks available for pre-commit.com, lefthook, and husky.
What .NET version is required?
.NET 10 SDK or later for the .NET global tool. Docker requires no .NET installation.
How do I report a security issue?
Email [email protected]. Do not open a public GitHub issue for security vulnerabilities.
What comes next?
Signal Sentinel Gateway (real-time MCP firewall) and Signal Sentinel Classify (document classification MCP server) are in development. See our product roadmap for details.
Secure your AI agent integrations today
32 security rules. Triple OWASP mapping. SARIF, offline mode, suppressions, triage, and counter-factual grading. Free, open source, and runs in seconds.
Last updated: August 2026