# Shrike Security (npm · shrike-mcp)

AI agent security scanner — prompt injection detection, SQL injection, PII isolation, threat intel.

- Trust score: 67/100 (medium)
- Change this week: +24
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- npm · `shrike-mcp`: 67/100 (this document), [markdown](https://verifymcp.io/servers/shrike-security-shrike-mcp/shrike-mcp.md), [page](https://verifymcp.io/servers/shrike-security-shrike-mcp/shrike-mcp)

## Channel facts

- Registry: `npm`
- Package: `shrike-mcp`
- Version: `1.1.1`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 87/100
  - No malware found by supply-chain analysis.
  - Only part of the dependency tree could be resolved (94 of 95), so this covers what we could see, not the whole tree.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (94 of 95), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (Apache-2.0).
  - Actively maintained (last published 17 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 65/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 1391 tokens (~198/item across 7 items; 7 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 27/100
  - Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add shrike-security-shrike-mcp -- npx -y shrike-mcp
```

### Codex

```bash
codex mcp add shrike-security-shrike-mcp -- npx -y shrike-mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "shrike-security-shrike-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "shrike-mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add shrike-security-shrike-mcp --command npx --arg -y --arg shrike-mcp
```

### Hermes

```yaml
mcp_servers:
  shrike-security-shrike-mcp:
    command: "npx"
    args: ["-y", "shrike-mcp"]
```

### Other

```json
{
  "mcpServers": {
    "shrike-security-shrike-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "shrike-mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-02 (score 67, +44)

- [security regression] Provenance: unverified → fail
- [security improvement] Install scripts: unverified → pass
- [security improvement] Known CVEs: unverified → partial
- [security improvement] Malware scan: unverified → pass
- [security] Stability: Stability not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet.
- [functional regression] Tool coverage: 100 → unverified
- [functional regression] Capabilities: pass → unverified
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] Stability: unverified → 0.23
- [functional improvement] License: unverified → pass
- [functional improvement] Schema quality: unverified → excellent
- [functional] Licence: Apache-2.0

### 2026-08-01 (score 23, +5)

- [security] Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window).
- [functional improvement] MCP protocol: unverified → pass

### 2026-07-31 (score 18, +12)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 6, −37)

- [security regression] Malware scan: pass → unverified
- [functional regression] Tool coverage: 100 → unverified
- [functional] First check of Schema quality: unverified

### 2026-07-27 (score 43)

First indexed and scored.

## MCP tools (7)

### `scan_prompt` (~258 tokens)

Scans text for security threats including PII, prompt injection, jailbreak attempts, and toxicity.

Returns a security assessment with:
\- blocked: true/false - whether the content was blocked
\- threat_type: category of threat detected (prompt_injection, jailbreak, pii_exposure, etc.)
\- severity: critical/high/medium/low
\- confidence: high/medium/low
\- guidance: actionable explanation of what was detected
\- request_id: unique identifier for this scan

If blocked=false, only request_id is returned (content is safe).

When redact_pii=true, PII is redacted client-side before scanning. The response includes:
\- pii_redaction.redacted_content: text with PII replaced by tokens like [EMAIL_1]
\- pii_redaction.tokens: array of {token, original, type} for rehydrating LLM responses
PII never leaves the MCP process when redaction is enabled.

Input parameters:

- `content` (string, required): The text content to scan for security threats
- `context` (string): Optional conversation history or context for better analysis
- `redact_pii` (boolean): When true, PII is redacted before scanning. Response includes redacted_content and tokens for rehydration.

### `report_bypass` (~243 tokens)

Reports content that bypassed security checks to help improve detection.

Supports multiple bypass types:
\- Prompt bypasses: Use 'prompt' field
\- File write bypasses: Use 'filePath' and/or 'fileContent' fields
\- SQL bypasses: Use 'sqlQuery' field
\- Web search bypasses: Use 'searchQuery' field

The bypass will be analyzed and may generate a new detection pattern.

Input parameters:

- `category` (string): Threat category (auto-inferred if not provided)
- `fileContent` (string): File content that should have been blocked (e.g., AWS keys, SSN)
- `filePath` (string): File path for file_write bypasses (e.g., config.yaml with undetected secrets)
- `mutationType` (string): Type of mutation used (e.g., semantic_rewrite, encoding_exploit, unicode_tricks)
- `notes` (string): Additional notes about the bypass
- `prompt` (string): The prompt that bypassed security detection
- `searchQuery` (string): Web search query with undetected PII
- `sqlQuery` (string): SQL query that bypassed injection detection

### `get_threat_intel` (~68 tokens)

Retrieves current threat intelligence including active detection patterns, threat categories, and statistics.

Input parameters:

- `category` (string): Filter by threat category (e.g., prompt_injection, jailbreak, pii_extraction)
- `limit` (number): Maximum number of patterns to return (default: 50)

### `scan_web_search` (~157 tokens)

Scans a web search query before execution for security issues.

Checks for:
\- PII in search queries (SSN, credit cards, API keys, private keys)
\- Data exfiltration patterns (searching for leaked credentials, Google dorks)
\- Blocked/suspicious domains (paste sites, suspicious TLDs)

Returns:
\- blocked: true/false
\- threat_type: blocked_domain, pii_exposure, etc.
\- severity: critical/high/medium/low
\- confidence: high/medium/low
\- guidance: actionable explanation
\- request_id: unique identifier

Input parameters:

- `query` (string, required): The search query to scan
- `targetDomains` (array): Optional list of target domains to validate

### `scan_sql_query` (~193 tokens)

Scans a SQL query before execution for security threats.

Checks for:
\- SQL injection patterns (UNION, stacked queries, tautologies, blind injection)
\- Destructive operations (DROP, TRUNCATE, DELETE without WHERE)
\- Privilege escalation (GRANT, CREATE USER)
\- PII extraction (queries on password/SSN/credit card columns)

Set allowDestructive=true to permit DROP/TRUNCATE for migrations.

Returns:
\- blocked: true/false
\- threat_type: sql_injection, etc.
\- severity: critical/high/medium/low
\- confidence: high/medium/low
\- guidance: actionable explanation
\- request_id: unique identifier

Input parameters:

- `allowDestructive` (boolean): Allow destructive operations like DROP/TRUNCATE (default: false)
- `database` (string): Optional target database name for context
- `query` (string, required): The SQL query to scan

### `scan_file_write` (~183 tokens)

Scans a file write operation before execution for security threats.

Checks:
\- Sensitive file paths (.env, credentials, SSH keys, certificates)
\- Path traversal attacks (../, system directories)
\- PII in content (SSN, credit cards, emails)
\- Secrets in content (API keys, passwords, tokens)
\- Malicious code patterns (reverse shells, fork bombs)

Returns:
\- blocked: true/false
\- threat_type: path_traversal, secrets_exposure, etc.
\- severity: critical/high/medium/low
\- confidence: high/medium/low
\- guidance: actionable explanation
\- request_id: unique identifier

Input parameters:

- `content` (string, required): The content to be written to the file
- `mode` (string): Write mode (default: overwrite)
- `path` (string, required): The target file path to write to

### `scan_response` (~289 tokens)

Scans an LLM-generated response before showing it to the user.

Detects:
\- System prompt leaks (LLM revealing its instructions)
\- Unexpected PII in output (PII not present in the original prompt)
\- Toxic or hostile language in generated content
\- Topic drift (response diverges from prompt intent)
\- Policy violations in generated content

Provide the original_prompt for best results — it enables PII diff analysis
and topic mismatch detection.

When pii_tokens is provided (from scan_prompt with redact_pii=true), the response
is rehydrated after scanning. Tokens like [EMAIL_1] are replaced with the original
values. The rehydrated text is returned as rehydrated_response.

Returns:
\- blocked: true/false
\- threat_type: category of threat detected
\- severity/confidence/guidance: security assessment details
\- rehydrated_response: (when pii_tokens provided and response is safe) text with PII restored
\- request_id: unique identifier

Input parameters:

- `original_prompt` (string): The original prompt that generated this response. Enables PII diff and topic mismatch detection.
- `pii_tokens` (array): PII token map from scan_prompt(redact_pii=true). When provided, tokens in the response are rehydrated with original values after scanning.
- `response` (string, required): The LLM-generated response to scan for security threats

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/shrike-security-shrike-mcp/shrike-mcp#diagnostics

## Score history

- 2026-08-03: 67
- 2026-08-02: 67
- 2026-08-01: 23
- 2026-07-31: 18
- 2026-07-30: 6
- 2026-07-28: 43
- 2026-07-27: 43

## Links

- npm package: https://www.npmjs.com/package/shrike-mcp
- Socket report: https://socket.dev/npm/package/shrike-mcp
- Repository: https://github.com/Shrike-Security/shrike-mcp
- Changelog RSS feed: https://verifymcp.io/servers/shrike-security-shrike-mcp/shrike-mcp/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/shrike-security-shrike-mcp/shrike-mcp/changelog.json
- HTML version of this page: https://verifymcp.io/servers/shrike-security-shrike-mcp/shrike-mcp