scan-eval

Documentation

Overview

Command scan-eval bridges the Spec 065 / D2 security corpus to mcpproxy's production sensitive-data detector and emits per-entry, per-detector verdict JSON for the Python SecurityScorer (B3). It is offline, deterministic test tooling — it adds no runtime or REST surface (Security-by-Default).

Usage:

scan-eval --corpus datasets/security_corpus_v1.json [--out verdicts.json]

The optional --scanners flag opts into Docker-isolated bundled security scanners (offline by default; set MCPPROXY_SCAN_EVAL_DOCKER=1 to enable container execution). Each requested scanner appends a per-entry verdict.