Firmis vs mcp-scan
Both tools scan for MCP security issues. They have different scope, depth, and use cases. This page compares them factually so you can choose the right tool - or use both.
Feature Comparison
| Feature | Firmis | mcp-scan |
|---|---|---|
| Platforms covered | Any platform (Claude, MCP, Codex, Cursor, CrewAI, AutoGPT, OpenClaw, Nanobot, Supabase) | 1 (MCP only) |
| Detection rules | Hundreds across 21 threat categories | Config checks |
| Analysis type | Static analysis + behavioral scoring | Config validation |
| Fix engine | Auto-remediation (quarantine, redact, tighten) | No |
| Runtime monitor | Behavioral anomaly detection | No |
| Pentest | MCP probe testing | No |
| Output formats | Terminal, JSON, SARIF, HTML | Terminal |
| CI/CD integration | firmis ci with fail gates | No |
| MCP server mode | Yes (firmis --mcp) | No |
| License | Apache-2.0 scanner / ELv2 engine | MIT |
Platforms covered
Detection rules
Analysis type
Fix engine
Runtime monitor
Pentest
Output formats
CI/CD integration
MCP server mode
License
Which Tool to Use
Use mcp-scan when
- - You only use MCP servers and need a quick config check
- - You want a minimal, MIT-licensed tool for MCP config checks only
- - You are already in the Snyk ecosystem
Use Firmis when
- - You use multiple AI platforms (Claude, Cursor, Codex, etc.)
- - You need deep rule coverage across 21 threat categories
- - You want CI/CD integration with fail gates
- - You need runtime behavioral monitoring or auto-remediation
- - You want SARIF or HTML output for compliance reports
Try Firmis in 30 Seconds
# No installation required
# MCP only (equivalent to mcp-scan scope)
Frequently Asked Questions
Is mcp-scan still actively maintained?
mcp-scan was acquired by Snyk through Invariant. Its maintenance trajectory depends on Snyk's priorities. Firmis is independently maintained with a public release cadence.
Can I use both tools together?
Yes. mcp-scan and Firmis are complementary. mcp-scan is fast for basic MCP config validation. Firmis covers a wider attack surface with deeper rule coverage and additional platforms.
Does Firmis require installation?
No. Firmis runs via npx without installation: npx firmis-cli init. It auto-detects your installed AI platforms and scans the relevant configs.
Try Firmis Free
Any AI agent platform. Hundreds of rules. No sign-up. Run it now.