Static-scan MCP tool definitions for injection and exfil
static_scan_toolsDetect prompt-injection, credential, and hidden-Unicode risks in advertised MCP tool definitions, then return findings with a gate score and ruleset digest.
Instructions
Run only the static-scan gate (ruleset v4, 25 signatures with context guards) over advertised tool names, descriptions, and input schemas. Returns findings, a 0..1 gate score, and the published ruleset digest.
When to use: you have a tools/list dump and want injection / credential / hidden-Unicode hits without origin, pinning, or the threat feed. Cheaper and narrower than vet_mcp_server.
When NOT to use: you need the full host decision (vet_mcp_server); you want operator glob classification (classify_sensitive_tools); you want the published rule table itself (list_scan_rules).
Behaviour: local regex+guard evaluation, no network, no mutation. Advisory-tier hits are reported with advisory=true and do not reduce the score. Does not launch servers or send tool output to a model.
Returns structured JSON matching outputSchema. Example: static_scan_tools({ tools: [{ name: "add", description: "Add two integers.", inputSchema: { type: "object" } }] }).
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| tools | Yes | tools/list items to scan (1..256). Same shape as vet_mcp_server.tools. |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| score | Yes | static-scan gate contribution: 1 minus the penalty for the worst non-advisory severity. Advisory hits do not change this number. | |
| ruleset | Yes | ||
| findings | Yes | Hits from the 25-rule table, including advisory-only codes. |