Skip to content
Back to Scanner

MCP Plugin Setup

Scan MCP servers directly from Claude Code, Cursor, Windsurf, Gemini CLI, or any MCP client.

Installation

Run directly with uvx (recommended, no install needed):

uvx mcpampel

Or install with pip:

pip install mcpampel
PyPI GitHub

Get an API Key

1 Create an account

Sign up at mcpampel.com/register. 50 API calls/day included.

2 Generate an API key

Go to Account and create a new API key. Copy the key starting with sk_live_.

3 Set the environment variable
export MCPAMPEL_API_KEY="sk_live_your_key_here"

Editor Configuration

Add MCPAmpel to your editor's MCP config. Select your editor below:

Restart your editor after saving the configuration.

HTTP Mode (Custom Agents)

The plugin also supports SSE transport for use with the Agent SDK or any HTTP-based MCP client.

Install with HTTP dependencies

pip install mcpampel[http]

Run in SSE mode

mcpampel --transport sse --port 8080

The SSE server listens on all interfaces by default. Use --host 127.0.0.1 to restrict to localhost.

Available Tools

Once configured, the plugin exposes four tools to your MCP client:

  • scan_my_servers - Discover all MCP servers in your config and scan them with 16 engines.
  • scan_url - Scan a single GitHub, GitLab, npm, or PyPI URL.
  • check_status - Show your daily usage and remaining quota.
  • get_scan_results - Get full detailed results for a specific scan by its ID.

Example Prompts

Try these prompts after installing the plugin:

Scan all your installed MCP servers

"Scan all my MCP servers for security issues."

Scan a specific repository

"Scan https://github.com/modelcontextprotocol/servers for security issues."

Scan an npm package

"Scan the npm package @modelcontextprotocol/server-everything for vulnerabilities."

Check your quota

"How many scans do I have left today on MCPAmpel?"

Get detailed results

"Show me the detailed scan results for scan ID a1b2c3d4-..."

← Back to Documentation

Questions? Check the API Reference or open an issue on GitHub.

This site uses a single session cookie to keep you logged in. No tracking cookies. See our privacy policy.