passive security & quality audit for sites built with ai
← website audit
MCP server audit
Paste a remote Model Context Protocol (MCP) server URL. We connect,
list its tools, and scan every name, description, and parameter for prompt-injection and tool-poisoning patterns —
hidden instructions aimed at your AI agent instead of you.
What we check
Every tool's metadata, scanned with deterministic
pattern rules — repeatable, no LLM in the scoring path.
-
injection phrasing
"ignore previous instructions", "don't tell the user", jailbreak language aimed at an AI reader
-
exfiltration hints
requests to read ~/.ssh, .env, /etc/passwd, .aws/credentials, or send data to an external URL
-
hidden unicode
zero-width characters and bidi-override tricks that hide text from a human reviewer
-
markup injection
<script> tags or javascript: URIs planted in tool metadata
-
oversized descriptions
unusually long tool descriptions that could hide a payload from a quick review
Why this matters
MCP servers are quickly becoming the default way AI agents reach outside their own sandbox — into
filesystems, databases, internal APIs, and third-party services. Every tool a server exposes comes with a
name and a description, and that description is read by the agent, not by you. A tool named innocuously —
read_file, search_docs — can carry a description instructing the agent to also
read your SSH keys or send data to an external URL, and to not mention it. That's tool poisoning, and it
doesn't show up in a normal glance at what a tool "does" — only in what its description says.
How the audit works
You give us a server URL. We run the standard MCP handshake — initialize, then
tools/list — the same two calls any MCP client makes before working with a server. No tool is
ever executed. Every tool's name, description, and parameter descriptions are scanned against deterministic
patterns for injection phrasing, credential/exfiltration hints, hidden unicode, and oversized descriptions.
You get back the exact matches, not a black-box score.
FAQ
What does the MCP audit check?+
We connect to the MCP server you give us, run the standard initialize / tools-list handshake, and scan every tool's name, description, and parameter descriptions for prompt-injection and tool-poisoning patterns — text aimed at an AI agent instead of a human, instructions to hide actions from the user, requests to read credentials or exfiltrate data, and hidden unicode tricks that make text invisible to a reviewer.
Do you call any of the server's tools?+
No. We only call tools/list (and prompts/list, best-effort). Nothing is executed on the target server — it's the MCP equivalent of reading a menu, not ordering from it.
Is this an LLM judging the server?+
No — the risk score comes only from deterministic pattern matching, so the result is repeatable and never depends on a model's mood. That also means it can miss cleverly worded injections a human or a model might catch; treat a clean result as "no known pattern matched," not a guarantee.
Do I need to own the MCP server I'm scanning?+
You should only scan servers you own or are authorized to test. We ask for that confirmation before running a scan, and log the time and address it was requested from.
Why does this matter?+
An MCP server's tool descriptions are read by your AI agent, not by you. A tool named innocuously can carry a description telling the agent to read your SSH keys or send data to an external URL — and unless you inspect the raw metadata, you'd never see it.