An MCP server gives an AI agent access to tools. Those tools may read files, call APIs, or run commands. Before connecting an agent to an unfamiliar server, it helps to understand what the server’s code can do.

But there’s a problem: if your security scanner imports the code to inspect it, the scanner may execute the very code you’re trying to evaluate.

While building Vexar-MCP, I chose a static-analysis approach: inspect source code without running the server. Here’s why that distinction matters, what static analysis can catch, and where it falls short.

Structure

1. The problem: inspecting an unfamiliar MCP server without trusting it.
2. Why importing code can be risky: explain side effects in plain language.
3. Your approach: how Vexar-MCP inspects source files without executing them.
4. One concrete example: detecting a potentially dangerous subprocess call.
5. Limitations: static findings are not proof of exploitability; a clean scan is not a security guarantee.
6. Closing: invite readers to try the tool and report false positives.
   
   
   Vexar-MCP is open source: github.com/RANJITHROSAN17/Vexar-MCP. I’d especially appreciate feedback on false positives and checks that would make MCP servers safer to review.

Suggested tags: Python, AI, Cybersecurity, Open Source, Software Engineering.