Back to browse
GitHub Repository

What can your AI agent do to the real world? Scan your code. See which tool calls have zero checks

7 starsPython

Diplomat-agent scan Python MCP servers for unguarded tool calls

by jguarnelli·Jun 25, 2026·3 points·0 comments

AI Analysis

●●●BangerBig BrainSolve My Problem

First security scanner specifically for MCP agent tool calls — found 70% unguarded in open-source repos.

Strengths
  • Scanned 16 open-source agent repos and found 70.9% of tool calls have zero guards — real data.
  • Zero dependencies, runs in 2 seconds on 1000-file repos using pure Python AST parsing.
  • Detects 40+ patterns across 8 categories including payments, deletes, and subprocess calls.
Weaknesses
  • Python-only support — no scanning for TypeScript, Go, or other agent frameworks yet.
  • Static analysis means it can't catch dynamic tool registration or runtime-generated calls.
Category
Target Audience

AI agent developers, security engineers deploying MCP servers

Similar To

Semgrep · Bandit · Safety

Similar Projects

Security●●Solid

mcpguard – security scanner and firewall for MCP servers

OWASP MCP Top 10 scanner and proxy firewall for AI agent tool calls.

Niche GemSolve My ProblemShip It
GTprojects
2026d ago