Verfy and MCP scanners
Scanners judge a tool when you scan it. Verfy is built for what happens after: the tool changes, the agent calls it, and someone later asks what ran. This page puts the tools side by side, using only what each project documents. We checked it on 24 October 2026; tell us if something has changed.
| Question | Snyk Agent Scan formerly Invariant Labs mcp-scan | Cisco MCP Scanner cisco-ai-defense | mcp-context-protector Trail of Bits | Verfy this project |
|---|---|---|---|---|
| What it is | Scanner for MCP servers, tools and agent skills; optional Agent Guard hooks | Scanner for MCP servers, tools, server source code and packages | Wrapper that sits between the client and an MCP server | Tool lock, a Claude Code hook, an MCP gateway and signed receipts |
| How tools are judged | Local checks plus the Snyk Agent Scan API | YARA rules locally; optional LLM analyzer and Cisco AI Defense API | Pinning; optional guardrail provider (e.g. LlamaFirewall) for tool responses | Deterministic local rules; no language model decides |
| Account or API key | Snyk account and SNYK_TOKEN | Optional (YARA works without one) | Not for pinning | None |
| Tool descriptions leave your machine | Yes, to the Snyk API (secrets redacted first) | Only with the LLM or AI Defense analyzers | Not for pinning | No |
| Notices a tool that changed after you approved it | Not described in its docs | Not described in its docs | Yes: trust-on-first-use pinning, unapproved changes blocked | Yes: verfy.lock, changed tools hidden and denied |
| Fails a pull request when a tool changed | Has a CI mode for scan findings; tool changes not described | Offline mode for scanning saved tool lists in CI | Not described | Yes: a lock file in the repository, checked by verfy lock check and a GitHub Action |
| Checks tool calls as they happen | Agent Guard hooks for Claude Code, Cursor, Codex and Copilot; the answer comes from the Snyk API | No, it scans | Blocks unapproved servers; guardrails can quarantine tool responses | Claude Code hook for every tool call, gateway for MCP tools; local answers |
| Signed record of each checked call | Not described | No | Not described | Yes: Ed25519-signed, hash-chained receipts; SCITT export |
| License | Apache-2.0 | Apache-2.0 | Apache-2.0 | CLI: MIT. Verfy Cloud (the hosted service) is proprietary |
What they do that Verfy does not
- Snyk Agent Scan also scans agent skills, finds more agents, and judges text with its analysis service.
- Cisco MCP Scanner reads server source code, scans packages in a sandbox, checks bundled files on VirusTotal and can ask a language model.
- mcp-context-protector can run a guardrail model over every tool response and quarantine suspicious ones.
- Verfy's rules are pattern matching: it will miss what a model or a code analyzer might catch.
What Verfy adds
- A lock file you commit, so a changed tool fails the pull request for the whole team, not only on one laptop.
- A check of every Claude Code tool call (shell, files, network), not only MCP tools, with no account and nothing sent anywhere.
- A signed, hash-chained receipt for every checked call that anyone can verify offline.
- Team approvals for tool changes and for calls that need a person.
They work together: run a scanner when you add a server, and Verfy to notice when it changes and to check what the agent does with it. Other open-source projects that hold back unreviewed servers or tools include MCPProxy. See also what Verfy does not cover.