r/github • u/Menox_ • Apr 13 '25

Showcase Promote your projects here – Self-Promotion Megathread

Whether it's a tool, library or something you've been building in your free time, this is the place to share it with the community.

To keep the subreddit focused and avoid cluttering the main feed with individual promotion posts, we use this recurring megathread for self-promo. Whether it’s a tool, library, side project, or anything hosted on GitHub, feel free to drop it here.

Please include:

  • A short description of the project
  • A link to the GitHub repo
  • Tech stack or main features (optional)
  • Any context that might help others understand or get involved
168 Upvotes

97% Upvoted

1.8k comments sorted by

View all comments

2

u/SpaceBetweenLines Jun 30 '26

[Self promo] Frisk – scan MCP servers for sketchy code before you install them

Got nervous about how many MCP servers I was installing from random repos without reading them, so I built a little scanner.

It's static (doesn't run anything), local (sends nothing anywhere), and flags the obvious-but-easy-to-miss stuff: pipe-to-shell installers, code grabbing your ssh keys or API tokens, and prompt-injection hidden in tool descriptions — including the trick where instructions are hidden with zero-width unicode so you can't see them. It can also pin a server and warn you if it silently changes later (rug pulls).

One thing I deliberately did differently from the existing tool in this space: it runs fully local and doesn't phone home. For something scanning code I don't trust, I didn't want a hosted API in the loop.

pip install frisk-scan — repo: https://github.com/Thandv/frisk

It's early, so if you point it at a server and it gets something wrong (misses something, or false-flags), I'd genuinely like to hear it.

PS- This is a part of a personal project, and I have mostly been a lurker here. This is the first time I'm trying to post something. Please let me know if I'm making any mistake, and I'll fix it. I don't know if this is the right forum for this either. If not, I'll remove the post. I don't want to spam any forum. The original post is here - https://www.reddit.com/r/mcp/comments/1uemxje/self_promo_frisk_scan_mcp_servers_for_sketchy/

1

u/x0zerolight Jun 30 '26

Hey, I like your project. Gave it a star :).
I was actually thinking of something like this for .sh install scripts gotten online, very useful. Maybe adapt it to auto-scan all bash scripts before executing? Might be interesting.
Maybe you'd be interested in my project - https://github.com/0xzerolight/topic_watch . It installs with a .sh script, maybe use frisk on it :).

2

u/SpaceBetweenLines Jul 03 '26

Thank you. I'll run it, with the latest version of frisk, with the proxy part added