Check a server's tool definitions (a tools/list snapshot) for poisoning indicators: hidden Unicode, instruction-like phrasing aimed at the model, references to other tools, exfiltration phrasing, encoded blobs, overlong descriptions, free-text parameters that invite conversation content, and duplicate names (TD001-TD008).

Use when: the user has a server's tool list (pasted JSON) and wants it checked. Prefer another tool when: the user only has a package or registry name, or wants a full check of a server (audit_server, which also takes the snapshot).

Takes pasted JSON text only (an object is rejected), never a path; nothing is fetched. Findings are indicators, not verdicts, and a report with no findings is not proof of safety. coverage lists the checks that ran and those skipped, with reasons.

Check an MCP Registry entry: declared repository URLs are consistent with its packages, the entry's owner matches its repository, its packages and versions exist, ownership markers, status (deleted, deprecated), and remote URLs (RG001-RG011).

Use when: checking a registry listing's consistency, status, ownership markers or remote URLs. Prefer another tool when: the user wants a full check of a server (audit_server).

Names are case-sensitive: copy the name exactly as the registry shows it; a name in another case is reported as not found. Remote and repository URLs are checked as text and never contacted. Findings are indicators, not verdicts, and a report with no findings is not proof of safety. coverage lists the checks that ran and those skipped, with reasons.

Check whether a package or MCP registry server name is suspiciously close to a known MCP server or package name: edit distance, confusable characters, affixes, and scope or namespace changes (TS001-TS006).

Use when: the user asks whether a name looks like a known MCP server or package, or is about to install something by a name they typed or were given. Prefer another tool when: the name is one the user already trusts and has verified, or the user wants a full check of a server (audit_server).

The name is compared against a dated reference list, never live popularity data. The reference list (data/reference_names.json) is dated 2026-11-03 (its generated_at field, returned in each report as data_sources[].as_of) and has 55988 entries: 6 PyPI and 4 npm names, which are curated names only, and 55978 registry names, crawled from the MCP Registry plus curated ones. A name close to none of them is not shown to be legitimate: the list is incomplete by nature. Findings are indicators, not verdicts, and a report with no findings is not proof of safety. coverage lists the checks that ran and those skipped, with reasons.

Check one PyPI or npm package version's supply-chain signals: known vulnerabilities (OSV.dev), yanked or deprecated state, install scripts (npm), provenance, publish recency (PyPI) and declared repository (PK001-PK006).

Use when: the user asks about a specific package (and version), e.g. one a config pins. Prefer another tool when: the user wants a full check of a server (audit_server).

Limits: large PyPI projects need an explicit version, because their project document exceeds the size cap used to resolve the latest. There is no install-script check for PyPI (build code is only in the sdist, which is never downloaded). npm version documents have no publish time, so recency is not checked for npm. Download counts, package age and owner history are not available. Findings are indicators, not verdicts, and a report with no findings is not proof of safety. coverage lists the checks that ran and those skipped, with reasons.

Check an MCP client config (Claude Code, Claude Desktop, Cursor or VS Code) for unpinned package runners, plain-http remotes, hardcoded secrets, shell wrappers, broad filesystem paths, non-registry package sources and risky env entries (CF001-CF007).

Use when: the user is reviewing a config they have or are about to copy. Prefer another tool when: the user asks about one server's tools (scan_tool_definitions), or whether a pinned package is safe (audit_package).

Takes pasted text only, never a path; no config value appears in the report. Findings are indicators, not verdicts, and a report with no findings is not proof of safety. coverage lists the checks that ran and those skipped, with reasons.

Run every check that applies to one MCP server and return one merged report.

Use when: any "is this MCP server safe to install?" question. Prefer another tool when: the user wants only one specific check.

For a registry name: audit_registry_entry, then audit_package for each pypi or npm package the entry lists (at most 3, at the listed version), and check_typosquat on the registry name and each package name. For a package name: audit_package and check_typosquat; the registry checks are recorded as skipped (a package name does not identify a registry entry). With tools_snapshot (JSON text only; an object is rejected), scan_tool_definitions too. Checks run concurrently under a 30 s deadline; a check that fails or does not finish is a skipped check naming it, and the rest of the report still returns. Coverage, findings and locations are prefixed with the sub-check name. The limits of each sub-check apply (see audit_package, audit_registry_entry and check_typosquat). Findings are indicators, not verdicts, and a report with no findings is not proof of safety. coverage lists the checks that ran and those skipped, with reasons.