A
licenseNot graded
qualityA
maintenancePerforms explainable, deterministic static analysis of MCP tool metadata to detect misleading instructions, concealed capabilities, and schema drift without executing tools.
1
MIT
AgentShield MCP Inspector Lite
by TYKAIRO-AI
In one line: This server lets you submit MCP tool metadata for basic, non-executing security inspection and get back an explainable risk verdict.
Analyze MCP tools via the single
analyze_toolstool, which accepts an array of tool definitions (each requiring aname, with optionaldescriptionandinputSchema).Inspect tool names, descriptions, and JSON Schemas for high-risk capability signals — shell/OS command execution, destructive file operations, filesystem reads, external network access, and secrets/credential access.
Produce verdicts of
SAFE,REVIEW, orHIGH RISKwith supporting evidence explaining the reasoning.Run safely — target tools are never executed; analysis is static metadata/schema inspection only.
Use it for a first-pass check on an MCP tool surface before deeper review or trust decisions (verdicts are signals, not proof).
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@AgentShield MCP Inspector LiteAnalyze these MCP tool definitions and flag any high-risk ones."
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
🛡️ AgentShield MCP Inspector Lite
A TYKAIRO AI product — Founded by Mahmoud Hisham
Free, local-first MCP security inspection for tool metadata, schemas, and high-risk capabilities.
AgentShield MCP Inspector Lite analyzes MCP tool names, descriptions, and input schemas and returns explainable verdicts:
SAFEREVIEWHIGH RISK
The goal is simple: inspect an MCP tool surface before trusting it.
AgentShield is a risk-inspection tool. A verdict is not proof that software is safe or malicious.
⚡ Quick start
git clone https://github.com/TYKAIRO-AI/AgentShield-MCP-Inspector.git
cd AgentShield-MCP-Inspector
npm install
npm test
npm run scan:sampleScan your own MCP tool metadata from JSON:
node src/cli.js scan-json examples/sample-tools.json --md-out report.md --json-out report.jsonOr run Lite as an MCP server:
node src/index.jsThe server exposes the analyze_tools tool.
Related MCP server: Secure Agent MCP Gateway
What Lite does
The starter ruleset looks for signals related to:
Shell / OS command execution
Destructive file operations
Filesystem reads
External network access
Secrets / credential access
It supports both static JSON scanning and MCP-server use.
Example workflow
MCP tool metadata
↓
AgentShield Lite
↓
Capability + schema inspection
↓
SAFE / REVIEW / HIGH RISK
↓
Evidence explaining whyThis makes it useful for developers, MCP publishers, reviewers, and teams that want a quick first-pass security check before deeper inspection.
Lite vs Pro
Lite is intentionally focused and public. AgentShield Pro is developed separately and is not included in this repository.
Planned Pro capabilities include:
Direct stdio MCP discovery
Expanded security rules
Allowlist / blocklist policy files
Trusted-domain policy
Better network classification
CI/CD exit codes and security gates
Scan history and scan diff
SARIF / advanced reporting
Source and package inspection
Remote MCP scanning
Advanced evidence and policy controls
Project status
Edition: Lite
Version: 0.1.0-lite.1
Runtime: Node.js 20+
Issues and feature ideas are welcome. If this project helps you evaluate MCP tools, consider starring the repository so more developers can discover it.
Contributing
See CONTRIBUTING.md.
Security
For security-related reports, see SECURITY.md.
Ownership
Publisher: Mahmoud Hisham
Organization: TYKAIRO AI
Copyright © 2026 Mahmoud Hisham. All rights reserved. See LICENSE.txt.
Available Tools
1 toolanalyze_toolsAnalyze MCP tool metadataB
Basic Lite-edition inspection of MCP tool names, descriptions and JSON Schemas without executing target tools.
ParametersJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| tools | Yes |
TDQS
B3.4/5.0
Behavior3/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the behavioral burden. It usefully discloses that the tool does not execute target tools, implying a non-mutating safety profile. It does not describe output format, limitations, or what 'Basic Lite-edition' means operationally.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness4/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is one compact sentence that front-loads the action and includes a useful safety qualifier. 'Basic Lite-edition' is somewhat redundant and undefined, but the overall structure is tight and easy to parse.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness3/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple one-parameter inspection tool, the description covers the input domain and the non-execution safety aspect. However, with no output schema and no sibling tools, the complete absence of return-behavior information and the undefined 'Lite-edition' scope leave meaningful gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters3/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema has only property names and 0% description coverage, so the description must supply parameter meaning. It connects the lone 'tools' parameter to MCP tool metadata (names, descriptions, JSON Schemas), which helps. But it adds no constraints, optionality guidance, or format details, so it only partially compensates for the missing schema documentation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose4/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific action ('inspection' of 'MCP tool names, descriptions and JSON Schemas') and a clear resource scope. It also explicitly distinguishes the tool from executing target tools. 'Basic Lite-edition' is vague, but the core purpose is still clear.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines3/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'without executing target tools' implies this is the safe, lightweight metadata-analysis choice rather than a runtime tool. However, it does not explicitly name alternatives, prerequisites, or conditions under which this tool should or should not be used.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
1 tool update
v0.1.0-lite.1- First observed
analyze_tools
TDQS
A3.7/5.0
Scored across 1 tool
Disambiguation5/5
Only one tool exists, so there is zero risk of an agent confusing it with another. The tool's purpose is clearly defined.
Naming Consistency5/5
The single tool uses a clear verb_noun pattern ('analyze_tools'), and with only one name there is no inconsistency to evaluate.
Tool Count3/5
A single tool is at the lower boundary of acceptable scope. It may be intentional for a 'Lite' edition, but the set feels very thin.
Completeness4/5
The tool covers the core inspection task (names, descriptions, schemas) without execution, but lacks any auxiliary operations like listing, comparing, or exporting results—though these may be outside the Lite scope.
Maintenance
ActivityMaintained
ResponsivenessNo issues
Related MCP Connectors
Find, vet, and run MCP tools through a secure audited gateway with prompt-injection risk scoring
Security & DLP proxy for MCP: tool-poisoning scans, PII redaction on tool args/results. Beta.
Statically audits MCP tool surfaces for token cost, schema quality, and design issues.
Scan any MCP server for tool-poisoning, security, auth & license. Trust score before install.
Related MCP Servers
- FlicenseNot gradedqualityCmaintenanceEnables AI agents to safely call MCP tools through a security gateway that enforces per-role authorization and least-privilege tool scoping.1-
- AlicenseNot gradedqualityBmaintenanceEnables MCP clients to scan tool manifests and server configs for prompt injection, tool poisoning, excessive agency, and other OWASP-mapped security issues directly through the scan_mcp_manifest tool.54 npm1MIT
- FlicenseNot gradedqualityCmaintenanceEnables MCP tool calls with strict schema validation and stdio isolation, while providing a security gateway for tool-level authorization, streaming PII redaction, and model failover routing.-