Get started

Introduction

What Aevrin scans, how it scores risk, and where to start.

Aevrin scans Model Context Protocol (MCP) servers for security risks before you trust them. Give it a repository, a local path, or a launch command, and it starts the server, reads the tools it actually exposes, and runs a fixed set of MCP security rules against them, then maps every result onto the OWASP MCP Top 10, so a finding means the same thing everywhere it appears: in the CLI and on the dashboard.

Aevrin is not a general-purpose code scanner. It will not tell you about a SQL-injection bug in an unrelated part of your repository, and it will not report Dockerfile style, CI configuration, or repository badges as security findings. It answers one question: is this MCP server safe to give an agent.

The four ways to use it

CLI

aevrin scan <target> runs every scanner locally and gives you a full report in your terminal.

Agent posture

aevrin agent scan reads Claude Code and Codex configuration on your machine and reports what each agent is allowed to do, without executing anything.

Dashboard

Every scan (CLI or dashboard) is saved to your account at varq.aevrin.ai, with full findings, stage-by-stage detail, and an OWASP MCP-mapped report export on Pro.

Aevrin MCP

Connect your agent with your Aevrin API key. It asks Aevrin for a capability and either Aevrin runs it and returns the output, or Aevrin returns the instructions to carry out here.

Quick start

pipx install aevrin
aevrin login
aevrin scan https://github.com/owner/mcp-server

See Getting Started for the full walkthrough, including installing on older Python versions.

What a scan actually checks

A repository or local-path scan clones (or reads) the target and runs, in order:

Finding and starting the server. Works out the command that starts the server from the repository's own package manifest, starts it in an isolated container, and reads the tools it offers. If there is no server to start, the scan says so and stops.
MCP rules. 75 rules over the server it started: tool poisoning, hidden instructions, command and code execution, file and network reach, secrets, tool shadowing, privilege requests, risky launch settings, and more. See Rules and coverage.
Supply chain, scoped to the scanned server itself: known malicious packages, typosquatted names, install scripts, loose or unpinned versions, and installs from a URL or git repository.

The grade is for the whole server, not for each tool, because you install the whole server. See Concepts.

Honesty over false confidence

Two things Aevrin is deliberately strict about, because a security scanner that can be tricked into saying "clean" is worse than no scanner at all:

An incomplete scan gets no grade at all. Not an A, not an F. If a scanner could not run, or if the server's tools could not be enumerated, the grade is ? and the report says why. Zero findings from a server nobody could read looks exactly like a perfect server, so Aevrin refuses to print a letter for it.
Not everything is tested. Prompt injection via a live tool's runtime responses (MCP08) requires dynamic, adversarial testing against a running server and is out of scope for static scanning. Every report says so explicitly rather than silently omitting it.