MCPScope

Who it's for

platform/security engineers at companies installing MCP servers from marketplaces (Smithery, mcp.so, GitHub) who today just read the README and skim the source before granting it API keys and filesystem access

The problem

legal/security exposure - a malicious or compromised MCP server has real network+filesystem access via prod credentials, and there's no automated way to catch undisclosed calls before granting it access; catching it after the fact means a breach, not just wasted time

How to build it

CLI: `mcpscope run <server-cmd>` wraps the server in a network-namespaced container, replays a scripted set of tool-invocation transcripts against it, and outputs a report (JSON+HTML) of outbound hosts contacted, files read/written, and tool names invoked vs. declared in its manifest

How it makes money

security/platform teams at companies with 20+ engineers pay $99-299/mo for continuous re-scan-on-version-bump plus Slack alerts, because a leaked credential incident costs far more than the subscription and static scanners (npm audit, manifest review) can't observe dynamic runtime network behavior

Why it doesn't exist yet

Anthropic and marketplaces could ship this but it requires building a behavioral sandbox harness across arbitrary runtimes (node/python/binaries), which is a narrow security-tooling problem orthogonal to shipping the MCP spec itself; an indie can ship an opinionated Docker-based harness faster than a platform team building a general one

First users

post free scans of popular MCP servers (the ones trending in mcp.so/Smithery leaderboards) in the MCP Discord and r/ClaudeAI as a lead magnet showing exactly what each server phones home to

Build size

2 people x 10 weeks - includes: Docker/network-namespace sandbox harness for Node/Python MCP servers, manifest-vs-actual-behavior diff report, CLI plus a minimal re-scan dashboard; excludes: sandboxing compiled binary-only servers, and live in-IDE blocking of tool calls

Biggest risk

a major MCP marketplace (Smithery, Anthropic's own registry) ships an official verified/sandboxed badge program natively, removing the need for a third-party scanner

Conditions for a hit (all 3 required)

• Produces a report listing every distinct outbound host/IP an MCP server contacted during a scan run
• Flags any runtime-invoked tool name that was not present in the server's declared manifest
• A version-to-version diff run highlights exactly which network or tool behaviors changed between two scans of the same server

How it's judged (in 6 months)

GitHub 300+ stars or Product Hunt top 10 on launch day(judgment date 2027-02-23)

AI self-confidence 45/100 — self-reported likelihood of meeting the criterion, not a business success rate