Free MCP Server Security Scanner — Audit MCP Manifests for Tool Poisoning

Input Payload (Editable JSON)

Live Edge Worker Output

{
  "ok": true,
  "data": {
    "score": 0,
    "grade": "F",
    "verdict": "block",
    "capabilities_detected": [
      "filesystem_read"
    ],
    "lethal_trifecta_detected": false,
    "findings": [
      {
        "id": "mcp_hidden_directive_tag",
        "category": "prompt_injection",
        "severity": "critical",
        "location": "tools[0] (read_note).description",
        "message": "Hidden directive tag or HTML comment detected in MCP description (classic MCP tool-poisoning vector).",
        "remediation": "Strip imperative instructions, HTML comments, and covert file/parameter directives from MCP metadata."
      },
      {
        "id": "mcp_covert_file_exfiltration",
        "category": "prompt_injection",
        "severity": "critical",
        "location": "tools[0] (read_note).description",
        "message": "Description instructs the agent to access sensitive host files (~/.ssh, .env, credentials) or perform covert pre/post actions.",
        "remediation": "Strip imperative instructions, HTML comments, and covert file/parameter directives from MCP metadata."
      },
      {
        "id": "prompt_guard_injection_signal",
        "category": "prompt_injection",
        "severity": "high",
        "location": "tools[0] (read_note).description",
        "message": "Prompt-injection heuristics triggered in MCP metadata (score 40: tool_abuse_shell_filesystem).",
        "remediation": "Ensure tool/prompt descriptions are purely declarative and do not override system instructions."
      },
      {
        "id": "open_additional_properties",
        "category": "schema_hygiene",
        "severity": "low",
        "location": "tools[0] (read_note).inputSchema",
        "message": "Tool 'read_note' inputSchema does not set 'additionalProperties: false'.",
        "remediation": "Set `additionalProperties: false` to prevent hallucinated or smuggled extra parameters."
      },
      {
        "id": "unconstrained_sensitive_parameter",
        "category": "schema_hygiene",
        "severity": "high",
        "location": "tools[0] (read_note).inputSchema.properties.path",
        "message": "Sensitive parameter 'path' accepts arbitrary unconstrained strings (no enum, pattern, or maxLength).",
        "remediation": "Restrict command/path/URL/SQL parameters with an explicit `enum`, strict `pattern`, or `maxLength`."
      }
    ],
    "counts": {
      "critical": 2,
      "high": 2,
      "medium": 0,
      "low": 1
    },
    "summary": {
      "tools_scanned": 1,
      "resources_scanned": 0,
      "prompts_scanned": 0,
      "servers_scanned": 0
    }
  },
  "meta": {
    "request_id": "req_mcp_01",
    "ms": 1
  }
}