Exepal

MCP server audit

scan_mcp

Read-onlyIdempotent

MCP server audit: connects to a remote MCP server (or takes its tools, resources and prompts), grades it A-F for tool poisoning, hidden Unicode, raw command/path inputs, destructive tools without annotations, name shadowing, resources pointing at credentials, poisoned prompts and insecure transport. Use before connecting an agent to an MCP server you did not write, or when a user asks whether an MCP server is safe. Pass url (Streamable HTTP; initialize, tools/list and, when advertised, resources/list and prompts/list are called, nothing is invoked or read) or tools[] (plus optional resources[] and prompts[]) from your own list calls for stdio servers. Returns grade A-F, score 0-100, verdict, server {name, version, protocolVersion, https, auth, capabilities}, toolCount, resourceCount, promptCount, findings[] {rule, severity, message, tool|resource|prompt, evidence}, tools[], resources[] and prompts[] each with risk and finding count. Any poisoning finding caps the grade at D. Not charged when the server is down or needs auth. Price: $0.005 per call from Exepal credit; not charged if the call fails. Includes free daily calls.

Tool call template

This tool declares no required parameters. Add optional parameters from the input schema as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {},
    "name": "scan_mcp"
  }
}

Input Schema

Name	Required	Description
`url`	No	Remote MCP server URL (Streamable HTTP), e.g. https://example.com/mcp
`tools`	No	Instead of url: the server's tools as returned by tools/list (for stdio servers or servers behind auth)
`headers`	No	With url: headers to send, e.g. {"Authorization": "Bearer ..."}. Used for the audit only, never stored
`prompts`	No	With tools[]: the server's prompts from prompts/list
`resources`	No	With tools[]: the server's resources from resources/list and resources/templates/list
`instructions`	No	With tools[]: the server's instructions string from initialize

Output Schema

Name	Required	Description
`grade`	No	A, B, C, D or F
`score`	No	0-100, higher is safer
`tools`	No
`server`	No
`prompts`	No	Up to 200
`verdict`	No
`findings`	No	Most severe first, up to 100
`fetchedAt`	No
`resources`	No	Up to 200
`toolCount`	No
`promptCount`	No
`resourceCount`	No

Schema Changelog

Changes observed during successful MCP inspections.

Changed9 schema fields changedNov 4, 2026

addedInput schema / properties / prompts

Added value: +{
+  "description": "With tools[]: the server's prompts from prompts/list",
+  "items": {
+    "type": "object"
+  },
+  "type": "array"
+}

addedInput schema / properties / resources

Added value: +{
+  "description": "With tools[]: the server's resources from resources/list and resources/templates/list",
+  "items": {
+    "type": "object"
+  },
+  "type": "array"
+}

addedOutput schema / properties / findings / items / properties / prompt
```
Added value: +{
+  "type": "string"
+}
```
addedOutput schema / properties / findings / items / properties / resource
```
Added value: +{
+  "type": "string"
+}
```
addedOutput schema / properties / promptCount
```
Added value: +{
+  "type": "number"
+}
```

addedOutput schema / properties / prompts

Added value: +{
+  "description": "Up to 200",
+  "items": {
+    "properties": {
+      "findings": {
+        "type": "number"
+      },
+      "name": {
+        "type": "string"
+      },
+      "risk": {
+        "description": "low, medium or high",
+        "type": "string"
+      }
+    },
+    "type": "object"
+  },
+  "type": "array"
+}

addedOutput schema / properties / resourceCount
```
Added value: +{
+  "type": "number"
+}
```

addedOutput schema / properties / resources

Added value: +{
+  "description": "Up to 200",
+  "items": {
+    "properties": {
+      "findings": {
+        "type": "number"
+      },
+      "name": {
+        "type": "string"
+      },
+      "risk": {
+        "description": "low, medium or high",
+        "type": "string"
+      },
+      "uri": {
+        "type": "string"
+      }
+    },
+    "type": "object"
+  },
+  "type": "array"
+}

addedOutput schema / properties / server / properties / capabilities

Added value: +{
+  "properties": {
+    "prompts": {
+      "type": "boolean"
+    },
+    "resources": {
+      "type": "boolean"
+    },
+    "tools": {
+      "type": "boolean"
+    }
+  },
+  "type": "object"
+}

Changed1 schema field changedNov 3, 2026
- addedInput schema / properties / url / format
```
Added value: +"uri"
```
AddedNov 3, 2026

TDQS

A4.6/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint/idempotent/non-destructive, and the description adds substantial context beyond them: only initialize, tools/list and advertised resources/list and prompts/list are called with 'nothing is invoked or read', headers are used for the audit only and never stored, poisoning findings cap the grade at D, and billing behavior is spelled out ($0.005 per call, free daily calls, no charge when the server is down, needs auth, or the call fails).

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with purpose and usage, then input modes, then returns and pricing — the ordering is sensible. It is dense, however, delivered largely as one long multi-clause sentence with heavy parentheticals, and it restates the return shape even though an output schema exists, which is redundant bulk.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a six-parameter tool with nested objects, dual input modes, and open-world network access, the description covers what is fetched, what is not touched, how modes are chosen, how grading is capped, and how billing works. An output schema exists, so the return summary is bonus rather than a gap-filler; nothing an agent needs to invoke it correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the schema already documents each parameter; the description still adds decision-level meaning by explaining that url and tools[] are mutually exclusive modes, that tools[] is intended for stdio servers or servers behind auth, and that resources[]/prompts[] come from the caller's own list calls. It does not clarify the optional instructions string beyond the schema, keeping it below a 5.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('MCP server audit: connects to a remote MCP server... grades it A-F') and enumerates exactly what is checked: tool poisoning, hidden Unicode, raw command/path inputs, destructive tools without annotations, name shadowing, credential-pointing resources, poisoned prompts, insecure transport. That scope is unmistakably distinct from siblings like scan_injection, scan_secrets, or guard, which operate on payloads rather than server manifests.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives explicit trigger conditions: 'Use before connecting an agent to an MCP server you did not write, or when a user asks whether an MCP server is safe.' It also routes between the two input modes (url for Streamable HTTP, tools[] for stdio or auth-protected servers). No explicit when-not or named sibling alternative is given, so it stops short of a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All Exepal tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources

Need Help?