The product
One instrument you can install, and the loop it belongs to.
mcpscan is the part that exists. It reads what an MCP server exposes and grades it. The rest of this page is the loop it was designed to feed, and that loop is not built.
uvx orisan-mcpscan scan-config ./mcp.json --yesShipped · mcpscan 0.1.1
What it does, in four steps.
Enumerate
Connects over stdio or Streamable HTTP, performs the MCP handshake and lists the tools, resources and prompts a server actually exposes.
Check
Runs 13 deterministic checks over those definitions. No model call decides whether something is a finding.
Adjudicate
Weighs each finding against the server's purpose and where that purpose came from, then grades A to F on the adjusted severity.
Report
Terminal, JSON, Markdown or SARIF. Every finding carries redacted evidence only and sets payload_stored=false.
Nothing leaves your machine unless you send it. It reports; it does not intervene in anything.
Seven pieces.
One is shipping.
One system in seven pieces, sharing one record and one switch. One of them you can install today.
Know what a server can do, without taking its word for it.
Deterministic. No model in the scanner.
Find what is already running: the agents, servers and credentials nobody wrote down.
See what an agent is about to send out, and where it goes.
Stand in the path of an action, so a bad one can be stopped rather than reported.
Check what the agent produced before a person or another system acts on it.
Where the rules are written and the evidence is kept.
How far one compromised agent reaches, across every server and credential it touches.
Public repositories are open and early.github.com/Orisan-org →
The loop · mostly not built
Watch. Decide. Stop.
Three verbs, and only the first has anything shipped under it. Naming the other two here is a statement of what we are building, not of what you can run.
Watch
Every native call an agent can make becomes one common shape. Today only one surface is read, and only before the agent connects rather than as it acts.
Decide
The same signal yields the same verdict every time: allow, hold for a human, or stop. Deterministic rules you can read.
Stop
The action is held at the boundary rather than reported after it lands, and the record states the intent.
The rule the design is built on
Anything we add can raise suspicion. Nothing we add can grant permission.
mcpscan is the first instance of it. A component that observes can tighten what happens next and has no path by which it loosens anything. That is why it grades and stops nothing, and why adding the next instrument cannot weaken the ones already there.
Run the part that exists.
Then tell us where the loop would break in your environment.
uvx orisan-mcpscan scan-config ./mcp.json --yes