// 01 > CONTEXT
mcp-sentry is a static-analysis security linter for TypeScript Model Context Protocol servers. It integrates with CI via SARIF, PR comments, and a public Shields.io badge.
// 02 > THE_PROBLEM
MCP servers expose tools to agents, and a mislabeled or injectable tool can hand an attacker command execution, with nothing flagging it in review.
There was no MCP-aware linter. Generic scanners miss MCP-specific risks like a read-only-named tool that mutates state, or untrusted input flowing into a shell call across function boundaries.
Before
No MCP-aware scanning · injection risks unflagged · intent mislabeling invisible
// 03 > APPROACH
I mapped the OWASP MCP Top 10 to concrete checks, added inter-procedural taint tracking for command injection, and made the whole thing CI-native with a gradeable threshold.
Inter-procedural taint tracking
Follows untrusted input across functions to catch command injection that single-function scanners miss.
Intent-subversion detection
Flags read-only-named tools that actually mutate state, a classic MCP trust violation.
// 04 > THE_RESULT
One scan grades an MCP server A to F across all eight OWASP MCP categories, fails CI on a threshold, and posts a public badge.
Before
- MCP risks unscanned
- Injection paths invisible
- No security signal in CI
After
- MCP01–MCP08 covered
- Taint-traced injection findings
- A–F grade + SARIF + badge
“Security tooling has to live where the work happens. mcp-sentry fails the build and posts the grade, so nobody has to remember to run it.”