Skip to main content
Glama
alexar76

warden

by alexar76
OverviewSchemaSourceRelated ServersDiscussionsAdmin
TypeScript
Local

Vet an MCP server through the full WARDEN gate chain

vet_mcp_server
Read-onlyIdempotent

Run WARDEN's ordered gate chain (static-scan → threat-feed → origin → pinning) over a server identity plus its advertised tools/list payload and return a recordable verdict (allow/block, 0..1 product score, findings…

Instructions

Run WARDEN's ordered gate chain (static-scan → threat-feed → origin → pinning) over a server identity plus its advertised tools/list payload and return a recordable verdict (allow/block, 0..1 product score, findings, allowedTools/blockedTools, ruleset digest).

When to use: you have a complete server record and want the same decision a host should make before any of those tool definitions reach the model. Prefer this over calling the four gates yourself.

When NOT to use: inspecting descriptions only (call static_scan_tools — no origin/pinning); splitting tools by operator glob (classify_sensitive_tools); checking one outbound URL (check_egress_url); producing RFC 8785 bytes (canonicalize_json).

Behaviour: local, deterministic, no network. This stdio process uses the built-in 11-record threat floor (it does not fetch a signed feed) and a durable local pin store. First contact is TOOL_DEF_UNPINNED/advisory until explicitly approved. Origin defaults to allowUnknownServers=true so catalog-discovered servers are not fail-closed. Override policy when you need the host's real knobs. Does not connect to, start, or approve the target server.

Returns structured JSON matching outputSchema. Example: vet_mcp_server({ server: { id: "demo@0", name: "demo", transport: "stdio", command: "npx" }, tools: [{ name: "add", description: "Add two integers.", inputSchema: { type: "object" } }] }).

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
toolsYesExact tools/list payload (1..256 tools). Each item is name + description + inputSchema from the server. Do not filter before vetting — blockedTools is the partition.
policyNoOptional WardenPolicy overlay. Omitted keys keep the stdio defaults: blockAtSeverity=high, empty sensitiveToolPatterns, allowUnknownServers=true, pinToolDefs=true. Use classify_sensitive_tools when you only want the glob split.
serverYesIdentity of the MCP server being vetted — the host's McpServerRef, not a live connection. WARDEN never launches this command or fetches this URL.

Output Schema

TableJSON Schema
NameRequiredDescriptionDefault
allowYesfalse when a gate was fatal or a non-advisory finding reached blockAtSeverity.
scoreYesProduct of per-gate scores in [0, 1]. One bad gate drags the whole server down; it is not an average.
findingsYesAccumulated findings across all gates, including advisory.
rulesetsYesRule-table identity in force for this verdict. Store this with the scan.
decidedByNoGate that produced the blocking decision, present only when allow is false.
allowedToolsYesTool names individually permitted; the host MUST also require allow=true before exposure.
blockedToolsYesTool names quarantined; the rest of the server may still be usable.

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed9 schema fields changedv0.16.0
    • addedInput schema / properties / policy / properties / capabilityBindings
      Added value: +{
+  "description": "Operator-reviewed capabilities, bound to launch identity and complete definitions. Unbound capabilities remain unknown.",
+  "items": {
+    "additionalProperties": false,
+    "properties": {
+      "identityHash": {
+        "type": "string"
+      },
+      "serverId": {
+        "type": "string"
+      },
+      "tools": {
+        "additionalProperties": {
+          "items": {
+            "enum": [
+              "private",
+              "untrusted",
+              "outbound"
+            ]
+          },
+          "type": "array"
+        },
+        "type": "object"
+      },
+      "toolsHash": {
+        "type": "string"
+      }
+    },
+    "required": [
+      "serverId",
+      "identityHash",
+      "toolsHash",
+      "tools"
+    ],
+    "type": "object"
+  },
+  "maxItems": 1000,
+  "type": "array"
+}
    • changedInput schema / properties / policy / properties / pinToolDefs / description
      Previous value: -"When true, tool-def drift after a stored pin is fatal. This process has an empty pin store, so first contact stays UNPINNED/advisory. Default true."New value: +"When true, tool-def drift after a stored pin is fatal. Pins persist across calls and restarts; first contact stays UNPINNED/advisory. Default true."
    • addedInput schema / properties / policy / properties / requireApproval
      Added value: +{
+  "description": "Require an explicit operator approval of every advertised field and server identity. Automatic and legacy pins do not qualify. Default false.",
+  "type": "boolean"
+}
    • changedInput schema / properties / tools / items / additionalProperties
      Previous value: -falseNew value: +true
    • addedInput schema / properties / tools / items / properties / annotations
      Added value: +{
+  "description": "Advertised hints; untrusted metadata, never authorization.",
+  "type": "object"
+}
    • addedInput schema / properties / tools / items / properties / outputSchema
      Added value: +{
+  "description": "Unmodified output schema, including nested descriptions; scanned and pinned.",
+  "type": "object"
+}
    • addedInput schema / properties / tools / items / properties / title
      Added value: +{
+  "description": "Unmodified advertised tool title; scanned and pinned.",
+  "type": "string"
+}
    • changedOutput schema / properties / allowedTools / description
      Previous value: -"Tool names the host may expose to the model."New value: +"Tool names individually permitted; the host MUST also require allow=true before exposure."
    • changedOutput schema / properties / rulesets / properties / staticScan / properties / version / description
      Previous value: -"Monotonic static-scan ruleset version (currently \"4\")."New value: +"Monotonic static-scan ruleset version (currently \"12\")."
  2. First observedv1.0.0

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover the safety profile (readOnly, idempotent, closed-world, non-destructive), yet the description adds substantial non-obvious behavior: local/deterministic/no-network, the built-in 11-record threat floor rather than a signed feed, a durable local pin store with first-contact UNPINNED/advisory, origin defaulting to allowUnknownServers=true, and the fact that it never connects to, starts, or approves the target.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with purpose, then cleanly sectioned when-to-use / when-NOT-to-use / behaviour / returns+example. Dense rather than padded, though it runs long and restates a couple of defaults (e.g. allowUnknownServers=true) that the schema already documents.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an outputSchema present it correctly avoids re-documenting the return shape while still summarizing the verdict fields, and it covers the identity/pinning/threat-feed semantics and policy defaults an agent needs to call this correctly. Nothing material is missing for a three-param, nested-object tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the three parameters (server, tools, policy) and every nested field are already documented in the schema; baseline 3 applies. The description adds a worked example invocation and a note that policy can be overridden with the host's real knobs, but no parameter syntax beyond what the schema carries.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (vet/run), the exact resource (WARDEN's ordered gate chain over a server identity plus its tools/list payload), and enumerates what the verdict contains. It also differentiates itself from siblings by naming the four gates and pointing to the tools that do partial work.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit 'When to use' with the precondition (a complete server record, wanting the host's pre-exposure decision) and a 'When NOT to use' section that routes each partial case to a named alternative: static_scan_tools, classify_sensitive_tools, check_egress_url, canonicalize_json. Nothing is left to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools