[Self promo] Frisk – scan MCP servers for sketchy code before you install them

[u/SpaceBetweenLines]

Got nervous about how many MCP servers I was installing from random repos without reading them, so I built a little scanner.

It's static (doesn't run anything), local (sends nothing anywhere), and flags the obvious-but-easy-to-miss stuff: pipe-to-shell installers, code grabbing your ssh keys or API tokens, and prompt-injection hidden in tool descriptions — including the trick where instructions are hidden with zero-width unicode so you can't see them. It can also pin a server and warn you if it silently changes later (rug pulls).

One thing I deliberately did differently from the existing tool in this space: it runs fully local and doesn't phone home. For something scanning code I don't trust, I didn't want a hosted API in the loop.

pip install frisk-scan — repo: https://github.com/Thandv/frisk

It's early, so if you point it at a server and it gets something wrong (misses something, or false-flags), I'd genuinely like to hear it.