YourAITools MCP Hub

InjectScan: Prompt-injection scan: MCP tool definitions

scan_tools

Read-onlyIdempotent

Checks MCP / function-calling tool definitions for tool poisoning (hidden instructions, data-exfiltration requests, hijack attempts in names, descriptions and schemas) before your agent installs or calls them. Up to 100 tools per call. Returns the worst risk_score/verdict, tools_flagged and tools[] {index, name, risk_score, verdict, findings[]}. Free: 30 calls/day per IP shared with scan_text and scan_url. Not for: ordinary content (use scan_text), web pages (use scan_url) or schema compatibility across models (use audit_tools). A safety signal, not a guarantee.

[InjectScan via YourAITools MCP Hub] Free tier: same as InjectScan's own MCP server (call without payment and without tier). Paid: scan $0.003 per call, with a credits key (Authorization: Bearer yatc_...) or x402 (USDC; the hub returns the payment terms). Failed tool calls aren't charged: credits are refunded automatically and x402 payments only settle on success.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "tools": "<tools>"
    },
    "name": "scan_tools"
  }
}

Input Schema

Name	Required	Description
`url`	No	(paid calls only)
`text`	No	(paid calls only)
`tier`	No	Paid tier: scan $0.003. Omit tier (with no credits key or x402 payment) to use the free tier.
`tools`	Yes	1-100 tool definitions as objects {name, description, inputSchema} (as returned by an MCP server's tools/list; input_schema or parameters are also read). Every string field, including nested schema descriptions, is scanned.

Schema Changelog

Changes observed during successful MCP inspections.

Changed1 schema field changedOct 30, 2026

addedInput schema / properties / tools / examples

Added value: +[
+  [
+    {
+      "description": "Returns the current weather for a city.",
+      "inputSchema": {
+        "properties": {
+          "city": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "city"
+        ],
+        "type": "object"
+      },
+      "name": "get_weather"
+    }
+  ]
+]

Changed2 schema fields changedOct 24, 2026
- removedInput schema / properties / tools / items / additionalProperties
```
Removed value: -true
```
- removedInput schema / properties / tools / items / properties / inputSchema / additionalProperties
```
Removed value: -true
```

Changed3 schema fields changedOct 24, 2026

addedInput schema / properties / tools / items / additionalProperties
```
Added value: +true
```

addedInput schema / properties / tools / items / description

Added value: +"A tool definition: name, description and inputSchema (MCP tools/list or OpenAI/Anthropic shape)."

addedInput schema / properties / tools / items / properties

Added value: +{
+  "description": {
+    "type": "string"
+  },
+  "inputSchema": {
+    "additionalProperties": true,
+    "description": "JSON Schema of the tool input.",
+    "properties": {
+      "type": {
+        "type": "string"
+      }
+    },
+    "type": "object"
+  },
+  "name": {
+    "type": "string"
+  }
+}

First observedOct 24, 2026

TDQS

A4.6/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly/idempotent/non-destructive, but the description adds material context beyond them: a concrete rate limit (30 calls/day per IP shared with scan_text and scan_url), the free-vs-paid mechanics (credits key or x402, refunds on failed calls), and an honest caveat that this is 'a safety signal, not a guarantee.' That last line is exactly the kind of expectation-setting an agent needs before trusting a verdict.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The purpose and the 'Not for' exclusions are front-loaded and the return shape is stated in one compact clause. The closing pricing/hub block is longer than an agent needs and partially duplicates the schema's tier descriptions, but it does carry the rate-limit and refund facts, so it earns most of its space.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema present, the description compensates by naming the return payload (worst risk_score/verdict, tools_flagged, tools[] with index, name, risk_score, verdict, findings). Combined with the batch limit, rate limit, and reliability caveat, an agent has everything needed to call this correctly and interpret the result.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the schema already documents all four parameters, including the tier enum and the payment-mode descriptions. The description's 'up to 100 tools per call' merely restates the schema's own '1-100 tool definitions' constraint, and it never explains the puzzling url/text parameters that sit alongside tools in this schema. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource — checking MCP/function-calling tool definitions for tool poisoning — and enumerates the exact vectors it inspects (hidden instructions, exfiltration requests, hijack attempts in names, descriptions and schemas). It explicitly names the siblings it is not (scan_text, scan_url, audit_tools), so an agent can route correctly without opening any schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides an explicit 'Not for:' block that routes three adjacent use cases to their correct alternatives (ordinary content → scan_text, web pages → scan_url, cross-model schema compatibility → audit_tools). It also states the timing of use ('before your agent installs or calls them') and the batch limit ('Up to 100 tools per call').

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All YourAITools MCP Hub tools Inspect

Try in Browser

Claude Code, inside the Godot 4 editorFlockbay puts an AI agent in the real Godot 4 editor: it writes GDScript, runs your game and fixes what breaks. Free, or bring your own Claude Code or Codex.flockbay.comAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources

Need Help?