Does MCPVault scan MCP servers for security issues?

Yes, MCPVault scans every claimed and verified MCP server once a week and publishes a security profile on the listing. The scanner is NVIDIA SkillSpector, an open source static analyzer for agent skills and MCP servers, run against a fresh snapshot of the repository without executing any code. The profile states what the shipped code can reach: the external hosts it talks to, whether it reads environment variables in bulk, runs shell commands, loads code at runtime, reads or writes other agents' configuration folders, touches credential files or needs elevated privileges. It also lists dependencies with known advisories from OSV.dev. There is no grade and no verdict. A browser tool has to run commands and an API wrapper has to call its API, so the profile shows the facts with file and line and leaves the decision to you. Owners see every item with a fix in their dashboard.