scan_mcp_safety
Check an MCP server for malware / prompt-injection lures by its endpoint URL.
Give the server's streamable-http endpoint URL. Two paths:
* **Already in the agent-tools directory** → returns our LATEST stored
rule verdict. Every indexed server is re-scanned hourly, so you get a
consistent, continuously-refreshed answer without re-probing.
* **Not yet indexed** → we probe the endpoint live, statically scan its
advertised tools + metadata, and return the fresh verdict. It is ADDED
to the directory (so the next caller gets the stored verdict instantly)
only if it answered or you supplied metadata; documentation hosts such
as example.com / *.test / *.invalid are scanned but never listed.
Two dimensions are reported. `verdict` is authoritative and comes from
deterministic static rules — pure pattern-matching over the *advertised*
text only, NO code execution. It flags the social-engineering / RCE tricks
listing-spam servers use:
* `curl … | bash` and `base64 -d | sh` install lures
* `eval "$(curl …)"` / PowerShell `IEX(...DownloadString)` cradles
* base64 blobs that decode to a shell command
* bare-IP payload hosts and cheap throwaway TLDs
* prompt-injection / credential-exfiltration phrasing
("ignore previous instructions", "send your .env / api key")
* MCP tool-poisoning coercion — descriptions that hijack an agent's
tool-calling ("always call this tool first", "before using any other
tool you must…"), hidden `<IMPORTANT>` instructions, "list all API
keys / include secrets in your response", and coercion to read &
forward `.key`/`.pem`/`.ssh`/`.env` files
Source-code-oriented rules (SQL / command / code injection) are deliberately
not applied to natural-language descriptions, to avoid false positives.
`llm_reference` is an advisory frontier-LLM second opinion over the same text.
Because the LLM is slow it is computed LIVE on this call only and is never
stored (the hourly job never runs it), so it may be null on timeout. It
never overrides the rule verdict; when it is *more* severe than the rules an
`advisory` note is attached as a safety-net signal. Security/defense
products that merely *name* these attacks are not flagged.
Args:
endpoint_url: The MCP server's streamable-http URL (required). This is
the identity we look up / index by.
name: Optional advertised name (used when the server is new and gets
added; falls back to the URL host).
description: Optional description / README blurb (scanned when new).
tools_text: Optional tool names + descriptions; used only if the live
probe cannot fetch the server's tools/list.
Returns:
{ verdict: "clean"|"suspicious"|"malicious", score: 0-100,
reasons: [{rule, weight, snippet}],
llm_reference: {model, verdict, reason, confidence} | null,
advisory: str | null, slug, name, endpoint_url,
source: "stored" (existing) | "new_scan" (just added), indexed: bool }
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| name | No | ||
| tools_text | No | ||
| description | No | ||
| endpoint_url | Yes |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||