Project Shield
Your MCP server has vulnerabilities.
Find them in 2 minutes.
Multi-layer security scans for AI-generated code and MCP servers. Detects leaked API keys, PII, prompt injection, and insecure configs.
Pro doesn't sell scans — it sells client-ready proof. PDF reports, Evidence Packs, verified badges.
<!-- Terminal Demo -->
<div class="terminal" style="margin-top:60px">
<div class="terminal-header">
<div class="terminal-dot red"></div>
<div class="terminal-dot yellow"></div>
<div class="terminal-dot green"></div>
<span class="terminal-title">terminal</span>
</div>
<div class="terminal-body">
$ npx project-shield scan ./my-mcp-server
🔍 Scanning 47 files...
✗ CRITICAL F001 API Key Exposed src/config.ts:12 AKIA5EXAMPLE... Detection: regex + entropy(4.8) + context("aws_key")
✗ CRITICAL F003 Prompt Injection tools/search.ts:45 "ignore previous instructions..." Detection: keyword + structure
⚠ WARNING F002 MCP No Auth mcp.json:1 No authentication configured
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ Score: 12/100 (F) | Status: 🔒 LOCKED 2 Critical · 1 Warning · 0 Info Fix-it guide: 3 actionable fixes available Badge: Locked — resolve critical issues first
MCP is the new attack surface
AI-generated code ships fast — but security doesn't keep up. MCP servers introduce an entirely new class of vulnerabilities.
arXiv:2506.13538 — 1,899 servers analyzed
arXiv:2506.13538 — hidden instructions in metadata
arXiv:2506.13538 — insecure defaults, missing auth
Veracode 2025 State of Software Security
Multi-Layer Detection
One layer misses. The next catches. Each vulnerability goes through 2–3 independent detection methods.
Pattern Matching
Known vulnerability signatures — regex patterns for API keys (AWS, Stripe, OpenAI…), PII formats, injection keywords, and MCP misconfigurations.
Entropy & Checksum
Mathematical verification — Shannon entropy analysis catches unknown key formats. Luhn algorithm validates card numbers. Checksum verifies national IDs.
Context Analysis
Smart filtering — variable names, file paths, and surrounding code determine if a match is a real threat or a false positive (test data, examples, comments).
3 layers for secrets · 2 layers for PII · 2 layers for injection · 5 checks for MCP
Critical vulnerability? Badge locked.
No false sense of security. If critical issues exist, your Scan Badge won't be issued until they're fixed. Fix-it guide included.
Not just a scan. A verifiable proof.
Every scan produces tamper-proof evidence. Clients can independently verify your security posture.
Unique Badge ID
Every Scan Badge has a UUID linked to a verification page. Anyone can check if the badge is authentic.
Hash-Sealed Results
Scan results are sealed with SHA-256 hash. Any modification is instantly detectable.
Evidence Pack
Full scan metadata — timestamp, ruleset version, file count, findings summary — bundled in a verifiable package.
Ruleset Integrity
Expert-curated rules with SHA-256 verification. Tampered rulesets are rejected before scanning begins.
Scan → Evidence → Trust
Why not just ask AI to check your security?
| AI (ChatGPT / Claude) | Project Shield | |
|---|---|---|
| MCP-specific rules | Generic advice | Research-based rules |
| Detection layers | Single pass | Multi-layer (2–3×) |
| Verifiable output | Chat response | Sealed Evidence Pack |
| False positive mgmt | None | shield-ignore + tuned thresholds |
| Client proof | Screenshot? | Verified Scan Badge + URL |
Block vulnerabilities before they ship.
Add one step to your GitHub Actions. Shield fails the build if critical issues are found.
Shield exits with code 1 on critical findings — your CI pipeline stops automatically.
Start free. Scale when ready.
No credit card required. Scan your project today.
- 5 scans / month
- Terminal report
- Watermarked Scan Badge
- Lock system applied
- Fix-it guide (summary)
- 50 scans / month
- Clean Scan Badge + verify page
- PDF report
- Evidence Pack (JSON + PDF)
- Full Fix-it guide with code snippets
- Scan history
- Unlimited scans
- 5 seats
- Dashboard
- Slack integration
- CI/CD gate
- Unlimited everything
- SSO / RBAC
- Audit trail
- SLA guarantee
- Compliance mapping
Free to scan. Locked until safe.
Verified when ready.
Run your first scan in under a minute. No signup required.
Click to copy
Get notified when Pro launches + security tips for MCP developers.
Server Config
{
"mcpServers": {
"project-shield": {
"command": "npx",
"args": [
"-y",
"project-shield",
"scan",
"."
]
}
}
}