A
licenseNot graded
qualityB
maintenancePerforms explainable, deterministic static analysis of MCP tool metadata to detect misleading instructions, concealed capabilities, and schema drift without executing tools.
1
MIT
BackBond Agent Scan
Officialby BackBond
Related Servers
Alternatives to BackBond Agent Scan
No user-submitted related servers found.
Related Servers
- AlicenseNot gradedqualityBmaintenanceEnables an agent or MCP client to scan MCP server configs and AI-agent tool manifests on demand, exposing tools that list detection rules and report hidden prompt injections, data-exfiltration attempts, embedded secrets, deceptive Unicode, unpinned packages and shell-launching tools. Each finding comes with a severity and location so risky tool descriptions can be caught before an attacker exploits them.28 PyPI1Apache 2.0
- AlicenseNot gradedqualityCmaintenanceEnables agents to vet MCP servers and agent configurations before trusting them, using local static analysis to detect injection, dangerous capabilities, exfiltration paths, and CVEs, with policy-based gating for CI.63 npmMIT
- AlicenseAqualityDmaintenanceVerify-before-act safety tools for AI coding agents, providing MCP tools to check packages, lockfiles, manifests, and CI workflows for supply chain risks.447 npmMIT
- AlicenseNot gradedqualityBmaintenanceEnables agents and operators to audit MCP tool permissions for least privilege, score blast radius, detect privilege-escalation chains, verify capability matrices, and produce cryptographic audit proofs with injection fuzzing and exfiltration canaries.7MIT
- AlicenseNot gradedqualityBmaintenanceEnables coding agents to run scope-checked probes of MCP endpoints, analyze tool definitions for poisoning and dangerous capabilities, detect definition drift, and generate reproducible evidence bundles and bounty-ready reports.MIT
TDQS
A4/5.0
Scored across 2 tools
Disambiguation3/5
Both tools perform static analysis of tool manifests and focus on exposure/gating, so their purposes overlap. Descriptions distinguish scanning the current runtime from vetting a proposed list before attachment, but an agent could still misselect when the intent is simply 'check tools for safety.'
Naming Consistency4/5
Both names use snake_case and start with an action verb, which is readable and mostly consistent. However, scan_my_runtime uses a first-person possessive while vet_tools_before_attach uses a temporal prepositional phrase, so they do not follow a single predictable verb_noun pattern.
Tool Count3/5
Two tools is thin for a security scanning server, even a focused one, and the overlap between them makes the small surface feel less intentional. It is not excessive, but it borders on under-scoped.
Completeness4/5
The server covers the two core moments in its apparent domain: scanning an existing runtime and gating proposed tools before attachment. Minor gaps remain around explaining findings, remediating issues, or configuring policy, but the central lifecycle is represented.
Maintenance
ActivitySlowing
ResponsivenessLimited data