Dynamic security for MCP servers

Every MCP server, tested in a sealed room before it meets your agent.

HIA installs and runs each server inside a gVisor sandbox with no internet and bait credentials, calls every tool, and watches what really happens. Then it tells you, in plain words, whether to trust it.

Scan a server Explore reports
  • gVisor isolation
  • No internet route
  • Honeytoken bait
  • Open A–F grading

The sealed room

We let the server misbehave, where it cannot hurt anyone.

Fake AWS keys, SSH keys and tokens wait in its home folder. Every exit leads to our sinkhole. If anything tries to leave, we see it, and so do you.

A package travels through the sandbox. A bait key it tries to send out is caught by the sinkhole. gVisor sandbox · no internet Install Run every tool Observe mcp Sinkhole key caught F

  1. Bait the room

    Fresh fake credentials, a per-scan CA and an internal network with a single exit: our sinkhole.

  2. Install for real

    The package installs as it would on your laptop, inside gVisor. Install scripts are watched too.

  3. Call every tool

    An MCP client lists the tools, resources and prompts, then calls each one with realistic input.

  4. Grade it A to F

    Files read, hosts contacted, programs started, secrets leaked: each finding costs points, with evidence.

Live from the scanner

Numbers from real scans, not a pitch deck.

0
scans run
0
servers reported
0
findings with evidence
0
% isolated in gVisor

Latest reports

Fresh out of the sandbox

See all reports

What HIA catches

Behavior, not promises.

A README can say anything. HIA looks at what the code does when it believes nobody is watching.

Credential theft

Bait AWS, SSH, GitHub and API keys. If one leaves the sandbox, even encoded, the grade is F.

Undeclared network

DNS, HTTP and TLS calls a tool never mentioned, including data hidden in DNS names.

Tool poisoning

Instructions aimed at your agent inside tool descriptions or responses, and invisible Unicode tricks.

Second stages

curl | sh, netcat, shells spawned from a tool call or an install script.

Rug pulls

Each version is compared with the last one. A tool that suddenly gains instructions is flagged.

Secret files

Reads of ~/.aws, ~/.ssh, .env and kube configs, weighed against what the tool says it does.

Open grading

One letter, and every point explained.

Start at 100. Each finding removes points by severity and confidence. Proof of a leaked secret is an F, whatever else happened. A scan that saw too little gets no letter at all, because silence is not safety.

A
90–100
B
75–89
C
60–74
D
40–59
F
0–39 or proof
–
not graded

For maintainers

Show your grade where people decide.

Add the HIA badge to your README. It updates with every new scan, and links to the full report.

HIA grade A badge Example badge 
[![HIA grade](https://hia.example/data/badges/your-server.svg)](https://hia.example/report.html?id=…)

Before you install

Give the server a room. Not your laptop.

Submit an npm or PyPI MCP server and read its report in minutes.

Scan a server Read the method