Static analysis for MCP servers

MCP Tool Poisoning Scanner

Paste the tool definitions an MCP server advertises, and this scans them for the things a model reads but a human usually does not: instructions aimed at the agent, hidden characters, tools that redefine other tools, and parameters shaped for exfiltration. Everything runs locally in this page.

What this is and is not. This is a static heuristic linter for tool definitions. It reads the JSON you paste and nothing else.

It cannot see what the server actually does at runtime.
It cannot detect a server that behaves well until it returns malicious content in tool results.
Definitions can change after you audit them. A server can serve a clean list today and a poisoned one tomorrow.
Heuristics produce false positives and miss novel phrasing. A clean report is not a safety guarantee.

Pin the server version you reviewed, and re-scan on every update.

Tool definitions

Accepts a JSON-RPC tools/list response, a bare array of tool definitions, or a single tool object.

Paste JSON

Get this by running the server and calling tools/list, or by copying the tool block out of the server's source. Nested inputSchema properties are walked recursively. Trailing commas and // comments are tolerated.

No scan yet Paste tool definitions above and press Scan, or press Load sample to see a realistic tools/list with one benign tool and three poisoned ones.

Findings

Grouped by tool, then by severity. Every finding names the check, the JSON path, and the excerpt that triggered it.

Reveal hidden characters

Every string that contains an invisible, control, or confusable character, rendered with the character replaced by a labeled marker.

Checks run

All checks run on every scan. This is the full list, so you can see what did not fire as well as what did.

Check	What it looks for	Findings	Status

Plain-text report

Paste this into a security review, a pull request, or a GitHub issue.