Before the Agent Calls exec(): Source-Level Findings from 100 MCP Servers

MCP servers wrap shells, filesystems, and HTTP clients and hand them to an AI agent. Thousands of them are now on npm, installable by anyone, audited by almost no one. I went looking for what's actually in them.

I audited 100 of the most-installed TypeScript MCP servers at the AST level and found 445 real findings across 70 servers which carried at least one exploitable pattern: command injection from tool input, path traversal, SSRF, and tool-poisoning through dynamically assembled descriptions, the class no prompt filter catches.

This talk covers what those patterns look like in real shipped code and how I built MCPeek to find them, an open source, offline SAST tool using ts-morph for AST traversal and multi-pass taint tracking, mapped to the OWASP MCP Top 10, with SARIF output that plugs into GitHub Code Scanning. No model, no cloud, no account. Runs on your machine, today, for free.

MCPeek is actively maintained and contributions are welcome. You leave this talk able to scan any TypeScript MCP server in under a minute and knowing exactly which three patterns to look for first in every security class.

Link to MCPeek: https://github.com/iamakash-06/MCPeek
NPM Package: https://www.npmjs.com/package/mcpeek

1. Identify five source level MCP vulnerability classes that exist below the prompt layer and that no runtime defense catches.

2. Run MCPeek which is an open source, offline, zero cost on any TypeScript MCP server in under a minute and interpret the output.

3. Wire MCPeek's SARIF findings into GitHub Code Scanning so MCP security becomes a required check on every pull request.

4. Know exactly when static analysis is the right layer and when you genuinely need a dynamic or runtime approach instead.

5. Understand MCPeek's architecture well enough to contribute a new detection rule or extend it to a new language.