>Plat.one

passive security & quality audit for sites built with ai

← website audit

MCP server audit

Paste a remote Model Context Protocol (MCP) server URL. We connect, list its tools, and scan every name, description, and parameter for prompt-injection and tool-poisoning patterns — hidden instructions aimed at your AI agent instead of you.

We call initialize and tools/list only — no tool is ever executed on the target. Remote, internet-facing servers only.

What we check

Every tool's metadata, scanned with deterministic pattern rules — repeatable, no LLM in the scoring path.

Why this matters

MCP servers are quickly becoming the default way AI agents reach outside their own sandbox — into filesystems, databases, internal APIs, and third-party services. Every tool a server exposes comes with a name and a description, and that description is read by the agent, not by you. A tool named innocuously — read_file, search_docs — can carry a description instructing the agent to also read your SSH keys or send data to an external URL, and to not mention it. That's tool poisoning, and it doesn't show up in a normal glance at what a tool "does" — only in what its description says.

How the audit works

You give us a server URL. We run the standard MCP handshake — initialize, then tools/list — the same two calls any MCP client makes before working with a server. No tool is ever executed. Every tool's name, description, and parameter descriptions are scanned against deterministic patterns for injection phrasing, credential/exfiltration hints, hidden unicode, and oversized descriptions. You get back the exact matches, not a black-box score.

FAQ

What does the MCP audit check?+
We connect to the MCP server you give us, run the standard initialize / tools-list handshake, and scan every tool's name, description, and parameter descriptions for prompt-injection and tool-poisoning patterns — text aimed at an AI agent instead of a human, instructions to hide actions from the user, requests to read credentials or exfiltrate data, and hidden unicode tricks that make text invisible to a reviewer.
Do you call any of the server's tools?+
No. We only call tools/list (and prompts/list, best-effort). Nothing is executed on the target server — it's the MCP equivalent of reading a menu, not ordering from it.
Is this an LLM judging the server?+
No — the risk score comes only from deterministic pattern matching, so the result is repeatable and never depends on a model's mood. That also means it can miss cleverly worded injections a human or a model might catch; treat a clean result as "no known pattern matched," not a guarantee.
Do I need to own the MCP server I'm scanning?+
You should only scan servers you own or are authorized to test. We ask for that confirmation before running a scan, and log the time and address it was requested from.
Why does this matter?+
An MCP server's tool descriptions are read by your AI agent, not by you. A tool named innocuously can carry a description telling the agent to read your SSH keys or send data to an external URL — and unless you inspect the raw metadata, you'd never see it.
Plat.one is built and operated by Semalt — passive checks only · no login · nothing written to your site
About · Privacy · Terms · Contact · © 2013–2026 Semalt