MCP Security Tools in 2026: What Two Scanners Missed and One Gateway Rule Caught

Description and use

In 2026, a test MCP server with four tools showed that two free scanners missed a hidden BCC instruction, while a single gateway rule successfully blocked it.

Problem

MCP servers can expose malicious instructions through tool descriptions or server code, evading free scanners but being caught by a gateway rule.

Outcome

The gateway rule successfully blocked a malicious BCC instruction that both free scanners missed, demonstrating the need for runtime gatekeeping in addition to static analysis.

Workflow

• 1. Set up MCP Python SDK 2.3.0 and register four tools.
• 2. Run Cisco MCP Scanner (YARA mode) against the server; it reports add and convert_units as unsafe, format_address as safe.
• 3. Run NVIDIA SkillSpector (no-llm) on the source; it flags add and convert_units but not format_address.
• 4. Deploy agentgateway v1.6.0 with a rule allowing only get_forecast.
• 5. List tools via gateway; only get_forecast is visible.
• 6. Attempt to call format_address directly (ok) and through gateway (rejected).

Evidence

Both ran without an account on October 12, 2026. Cisco MCP Scanner launches the server over stdio and checks it against local YARA rules:

Source

Both let the BCC instruction through. A single gateway rule is what removed it.

Source

The BCC written into a server's implementation slips past both, so pinning exact versions is still part of the job.

Source