Skip to main content
Glama
@guardbee/mcp-security-proxy

@guardbee/mcp-security-proxy

Official

rug_pull_detector__check_server

Connects to an MCP server and compares its current tools/list response with a stored baseline to detect rug pulls—tools whose descriptions, schemas, or annotations changed since approval.

Instructions

Connect to an MCP server and compare its current tools/list response against the stored baseline. A tool whose description, schema, or annotations changed since baseline is a 'rug pull' — approved once, silently different now. If no baseline exists yet, one is captured automatically (set autoBaseline=false to require an explicit baseline_server call first).

Input Schema

NameRequiredDescriptionDefault
cwdNoWorking directory for the spawned process
envNoExtra environment variables for the spawned process
urlNoURL of a Streamable HTTP MCP server (alternative to command/args)
argsNoArguments for the stdio command
labelNoStable identifier for this server, used to look up its baseline. Defaults to the command line or URL.
commandNoCommand to spawn for a stdio MCP server (e.g. "npx")
autoBaselineNoAutomatically capture a baseline if none exists yet (default: true)

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed1 schema field changedv0.1.5
    • changedInput schema / $schema
      Previous value: -"http://json-schema.org/draft-07/schema#"New value: +"https://json-schema.org/draft/2020-12/schema"
  2. Addedv0.1.1

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries full burden and discloses a critical side effect: it connects to a server and auto-captures a baseline (a state mutation). It also explains the autoBaseline toggle's consequence. It does not cover process-spawning/networking implications or error/timeout behavior when the server is unreachable.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three compact sentences, each earning its place: what it does, what counts as a rug pull, and the baseline-fallback behavior. The core action is front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

It covers the operation and the important autoBaseline fallback well for a 7-param tool. Since there is no output schema, the description could say more about what the comparison returns (e.g., changed-tool list), but the core callable behavior is well captured.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so baseline is 3. The description adds value beyond the schema by explaining the runtime consequence of autoBaseline=false (requiring an explicit baseline_server call first), linking the parameter to the sibling tool's workflow rather than just restating the default.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb+resource ('compare its current tools/list response against the stored baseline') and explicitly defines what a 'rug pull' is. It distinguishes itself from the sibling baseline_server tool by explaining the relationship between baselining and checking.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It clearly specifies the baseline-existence condition ('If no baseline exists yet, one is captured automatically') and names the alternative path via 'set autoBaseline=false to require an explicit baseline_server call first'. It gives clear context but doesn't fully spell out when to prefer check_server over list_baselines or other auditors.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools