warden

Overview Schema Source Related Servers Discussions Admin

Static-scan MCP tool definitions for injection and exfil

static_scan_tools

Read-onlyIdempotent

Run only the static-scan gate (ruleset v12, 35 signatures with context guards, text folded first) over every advertised tool field: name, description, input schema, title, output schema, annotations and extension metadata.

Instructions

When to use: you have a tools/list dump and want injection / credential / hidden-Unicode hits without origin, pinning, or the threat feed. Cheaper and narrower than vet_mcp_server.

When NOT to use: you need the full host decision (vet_mcp_server); you want operator glob classification (classify_sensitive_tools); you want the published rule table itself (list_scan_rules).

Behaviour: local regex+guard evaluation, no network, no mutation. Advisory-tier hits are reported with advisory=true and do not reduce the score. Does not launch servers or send tool output to a model.

Returns structured JSON matching outputSchema. Example: static_scan_tools({ tools: [{ name: "add", description: "Add two integers.", inputSchema: { type: "object" } }] }).

Input Schema

TableJSON Schema

Name	Required	Description	Default
`tools`	Yes	tools/list items to scan (1..256). Same shape as vet_mcp_server.tools.

Output Schema

TableJSON Schema

Name	Required	Description
`score`	Yes	static-scan gate contribution: 1 minus the penalty for the worst non-advisory severity. Advisory hits do not change this number.
`ruleset`	Yes
`findings`	Yes	Hits from the 25-rule table, including advisory-only codes.

Schema Changelog

Changes observed during successful MCP inspections.

Changed5 schema fields changedv0.16.0Oct 14, 2026

changedInput schema / properties / tools / items / additionalProperties
```
Previous value: -falseNew value: +true
```

addedInput schema / properties / tools / items / properties / annotations

Added value: +{
+  "description": "Advertised hints; untrusted metadata, never authorization.",
+  "type": "object"
+}

addedInput schema / properties / tools / items / properties / outputSchema

Added value: +{
+  "description": "Unmodified output schema, including nested descriptions; scanned and pinned.",
+  "type": "object"
+}

addedInput schema / properties / tools / items / properties / title

Added value: +{
+  "description": "Unmodified advertised tool title; scanned and pinned.",
+  "type": "string"
+}

changedOutput schema / properties / ruleset / properties / version / description

Previous value: -"Monotonic static-scan ruleset version (currently \"4\")."New value: +"Monotonic static-scan ruleset version (currently \"12\")."

First observedv1.0.0Sep 5, 2026

TDQS

A4.9/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already establish readOnly, idempotent, non-destructive, and closed-world behavior. Beyond that, the description discloses that evaluation is local regex+guard based, has no network or mutation, does not launch servers or send tool output to a model, and reports advisory-tier hits with advisory=true without reducing the score. That is rich behavioral context an agent could not infer from annotations alone.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the core action, then cleanly structured into When to use, When NOT to use, Behaviour, and Returns sections. Each sentence earns its place by adding routing logic, behavior, or invocation shape without waste.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity, the rich input schema, the output schema, and the annotations, the description is complete. It covers scope, alternatives, execution model, scoring behavior, return shape, and an example, so an agent has everything needed to invoke it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents the tools array and its nested fields well. The description adds useful scope beyond the schema by enumerating the scanned field set, including extension metadata, and by giving a concrete example invocation that clarifies the expected tools/list shape.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: run the static-scan gate over advertised MCP tool fields. It explicitly distinguishes itself from vet_mcp_server, classify_sensitive_tools, and list_scan_rules, so an agent can route correctly without opening sibling schemas.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives explicit when-to-use and when-NOT-to-use sections, naming the exact alternatives for the excluded cases: vet_mcp_server, classify_sensitive_tools, and list_scan_rules. The condition for choosing this tool — a tools/list dump needing injection/credential/Unicode hits without origin, pinning, or threat feed — is unambiguous.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server