Skip to main content
Glama
Sign In
@guardbee/mcp-security-proxy

@guardbee/mcp-security-proxy

Official
by GuardBee
OverviewSchemaSourceRelated ServersDiscussionsAdmin
TypeScript

tool_poisoning_scanner__scan_text

Scans MCP server source code for hidden instructions in tool descriptions and confused-deputy tools whose handlers expose shell, eval, file-write, or env-dump sinks.

Instructions

Scan MCP server source (TypeScript/JavaScript, Python, Go) for tool poisoning (hidden instructions embedded in a tool's description string, read by the calling LLM as trusted context) and confused-deputy tools (a name/description promising read-only behavior while the handler has a shell/eval/file-write/env-dump sink).

Input Schema

NameRequiredDescriptionDefault
labelNoOptional label shown in findings (e.g. filename); its extension picks the language
contentYesThe source code to scan
languageNoSource language, when the label has no extension (default: typescript)

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed1 schema field changedv0.1.5
    • changedInput schema / $schema
      Previous value: -"http://json-schema.org/draft-07/schema#"New value: +"https://json-schema.org/draft/2020-12/schema"
  2. Changed2 schema fields changedv0.1.3
    • changedInput schema / properties / label / description
      Previous value: -"Optional label shown in findings (e.g. filename)"New value: +"Optional label shown in findings (e.g. filename); its extension picks the language"
    • addedInput schema / properties / language
      Added value: +{
+  "description": "Source language, when the label has no extension (default: typescript)",
+  "enum": [
+    "typescript",
+    "javascript",
+    "python",
+    "go"
+  ],
+  "type": "string"
+}
  3. Addedv0.1.1

TDQS

B3.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full load: it discloses the detection semantics (what patterns count as poisoning vs. confused deputy) which is genuine added value. However it never states that this is a non-mutating local analysis, whether findings include severities/line numbers, or any limits on input size, so an agent cannot predict the response shape.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence with no filler; every clause defines a threat class or a supported language. It is dense with nested parentheticals, which slightly slows parsing, but nothing is redundant.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Purpose and input languages are well covered, but with no output schema and no annotations, the description should say more about what a finding looks like (rule IDs, severity, location) and point to scan_file/scan_directory for multi-file audits. An agent knows what the tool detects but not what it returns.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so all three parameters (label, content, language) are already documented in the schema, including the extension-based language inference and the typescript default. The description only echoes the supported language list, adding nothing beyond the enum. Baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (scan) and resource (MCP server source in TS/JS, Python, Go) plus the exact threat classes detected: tool poisoning via hidden instructions in a tool's description string, and confused-deputy tools whose name/description promises read-only while the handler has a shell/eval/file-write/env-dump sink. These definitions distinguish it from generic siblings like prompt_injection_scanner__scan_text or ai_code_scanner__scan_text without needing to name them.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description never says when to use this versus scan_file or scan_directory, nor does it state prerequisites (e.g. that 'content' must be raw source, not a path). The scan_text/scan_file/scan_directory naming convention implies the split, but the description itself gives no routing guidance or exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools