Does MCPVault scan MCP servers for security issues?

Yes, MCPVault scans every claimed and verified MCP server for security issues once a week and publishes the result as a score card on the listing. The scanner is NVIDIA SkillSpector, an open source static analyzer for agent skills and MCP servers, run against a fresh snapshot of the repository without executing any code. It checks lockfiles against OSV.dev for known CVEs, looks for bulk environment harvesting, credential file access, taint flows from environment variables into shell or network calls, hidden instructions in agent-facing files and malware signatures. MCPVault applies its own MCP-server weighting so that a README comment or an ordinary API call does not count as an attack. The card shows a 0 to 100 score, the top findings with file and line, the vulnerable dependencies and the external hosts the code talks to. Owners see every finding with a fix in their dashboard.