Vet an MCP server through the full WARDEN gate chain
vet_mcp_serverVets an MCP server and its advertised tools through WARDEN's ordered gate chain, returning an allow/block verdict, findings, and allowed/blocked tool lists before definitions reach the model.
Instructions
Run WARDEN's ordered gate chain (static-scan → threat-feed → origin → pinning) over a server identity plus its advertised tools/list payload and return a recordable verdict (allow/block, 0..1 product score, findings, allowedTools/blockedTools, ruleset digest).
When to use: you have a complete server record and want the same decision a host should make before any of those tool definitions reach the model. Prefer this over calling the four gates yourself.
When NOT to use: inspecting descriptions only (call static_scan_tools — no origin/pinning); splitting tools by operator glob (classify_sensitive_tools); checking one outbound URL (check_egress_url); producing RFC 8785 bytes (canonicalize_json).
Behaviour: local, deterministic, no network. This stdio process uses the built-in 11-record threat floor (it does not fetch a signed feed) and a durable local pin store. First contact is TOOL_DEF_UNPINNED/advisory until explicitly approved. Origin defaults to allowUnknownServers=true so catalog-discovered servers are not fail-closed. Override policy when you need the host's real knobs. Does not connect to, start, or approve the target server.
Returns structured JSON matching outputSchema. Example: vet_mcp_server({ server: { id: "demo@0", name: "demo", transport: "stdio", command: "npx" }, tools: [{ name: "add", description: "Add two integers.", inputSchema: { type: "object" } }] }).
Tool call template
Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.
{
"id": 1,
"jsonrpc": "2.0",
"method": "tools/call",
"params": {
"arguments": {
"server": "<server>",
"tools": "<tools>"
},
"name": "vet_mcp_server"
}
}Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| tools | Yes | Exact tools/list payload (1..256 tools). Each item is name + description + inputSchema from the server. Do not filter before vetting — blockedTools is the partition. | |
| policy | No | Optional WardenPolicy overlay. Omitted keys keep the stdio defaults: blockAtSeverity=high, empty sensitiveToolPatterns, allowUnknownServers=true, pinToolDefs=true. Use classify_sensitive_tools when you only want the glob split. | |
| server | Yes | Identity of the MCP server being vetted — the host's McpServerRef, not a live connection. WARDEN never launches this command or fetches this URL. |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| allow | Yes | false when a gate was fatal or a non-advisory finding reached blockAtSeverity. | |
| score | Yes | Product of per-gate scores in [0, 1]. One bad gate drags the whole server down; it is not an average. | |
| findings | Yes | Accumulated findings across all gates, including advisory. | |
| rulesets | Yes | Rule-table identity in force for this verdict. Store this with the scan. | |
| decidedBy | No | Gate that produced the blocking decision, present only when allow is false. | |
| allowedTools | Yes | Tool names individually permitted; the host MUST also require allow=true before exposure. | |
| blockedTools | Yes | Tool names quarantined; the rest of the server may still be usable. |