Paste an MCP server's tools/list and audit its catalogue quality: context cost, annotations, instructions and official registry compliance. This is not an access-security auditor or a live debugger — check the help to see what this is and isn't.
How to use
What this checks
Paste the tools/list response of an MCP server —yours, or anyone's— and it checks catalogue quality: missing descriptions and annotations, tools whose name suggests they write or delete while their annotations say otherwise, context cost per tool, whether the catalogue's instructions field is set and fits under ~2 KB, and whether any description hides an instruction meant for the model (tool poisoning). Nothing leaves your browser.
Registry manifest (optional)
Paste server.json too and it checks the official MCP registry's own limits (field lengths, the namespace pattern) BEFORE it rejects your publish with a 422 or a 403 —the two errors we already suffered publishing our own packages. Add package.json to also catch a version mismatch between the two, which the registry rejects with a 400 after you've already authenticated.
Tool poisoning
A tool can carry a hidden instruction: invisible to you —you only see the name— but visible IN FULL to the model (real case: Invariant Labs, "MCP Tool Poisoning Attacks", April 2025 — an add tool with an <IMPORTANT> tag asking to read ~/.ssh/id_rsa and slip it into a parameter). It is searched for in the description and in the whole schema —parameter names, non-standard fields, default, enum, required—, which is where CyberArk showed it hides too (Full-Schema Poisoning), and also in anything encoded in base64, hex or %xx. It is marked “critical” only when the same tool asks to read something sensitive AND send it. And separately, “Gives orders about another tool”: a description that sets conditions on a tool from ANOTHER server (the send_email in Invariant’s example). Engine by @seguridad, not this tool’s own.
Rug pull: the catalogue that changes later
A server can show a harmless catalogue on the day you approve it and change it later: the protocol lets it announce a new catalogue on the fly, and many clients never ask you again. Paste the tools/list you approved into the optional fields and it is compared with today's: new or removed tools, descriptions that now carry hidden instructions, new parameters (where data would leave) and annotations that stopped saying "read-only".
What this does NOT check
This audits catalogue DESIGN, not access security. For "which MCP servers does this repo trust, and what can they do" use the Agent file auditor. For live protocol debugging, use Anthropic's official @modelcontextprotocol/inspector. Tool names that are confusable with each other, and unsafe code patterns in the server's SOURCE, are not checked yet.
