Research · curated 18 Sep 2026
Can MCP Security Scanners Miss Malicious Servers?
First reported pluto.security
Coverage timeline
Single-source research — first reported, latest, and curated coincide.
Why it matters
MCP security scanners are a control users rely on before installing servers, and this research shows a clean scan can hide credential theft and remote code execution, giving defenders a false sense of safety.
Pluto Research tested five public MCP security scanners (Cisco mcp-scanner, Snyk agent-scan, Ventrova sentinel-scan-cli, mcp-shield, and NVIDIA SkillSpector) against two working malicious MCP servers — a credential thief that exfiltrated SSH, AWS, and Kubernetes credentials and a remote-code-execution server — both disguised as ordinary weather tools. Each scanner returned a clean or zero-finding result in at least one tested configuration; for example, SkillSpector's LLM review skipped files after a 16 MiB size limit, and metadata-only scanners inspected only tool names, descriptions, and schemas. The team submitted four upstream fixes.