# mcp-tool-poison-guard

**Production-ready MCP Server that detects and guards against Tool Poisoning & Prompt Injection attacks in MCP tool descriptions and schemas.**

Zero external API cost. Pure local computation + heuristics. Built for entrepreneurs and teams who deploy AI agents in enterprise environments and need trust & accountability.

## The Problem (Why this exists)

AI agents using MCP can be tricked by "tool poisoning":
- Malicious instructions hidden inside tool `description` or `inputSchema`
- When the LLM reads the tool list, it follows the hidden commands (exfiltrate secrets, call restricted tools, ignore system prompt)
- This is a real 2025-2026 attack class (OWASP, Invariant Labs, academic papers)

Most agents blindly trust tool metadata. This MCP server gives your agents (or your CI/CD) the ability to **scan, score, and sanitize** tools before they are used.

## What this MCP gives your agents

| Tool | What it does |
|------|--------------|
| `scan_tool_description` | Score a single tool description for poisoning risk (0-100) |
| `scan_tools_list` | Batch-scan a full `tools/list` response and rank by risk |
| `detect_injection_patterns` | List all known injection / poison patterns found |
| `rewrite_safe_description_tool` | Generate a cleaned, safe version of a poisoned description |
| `generate_audit_report` | Produce a compliance-friendly audit report of a tool set |
| `simulate_poison_attack` | Educational: show what a poisoned tool looks like (for testing) |

## Quick Start

```bash
# 1. Clone
git clone https://github.com/princeruhulofficial/mcp-tool-poison-guard.git
cd mcp-tool-poison-guard

# 2. Install
pip install -e .

# 3. Run (stdio – works with Claude Desktop, Cursor, etc.)
python -m mcp_tool_poison_guard
```

### Claude Desktop config example

```json
{
  "mcpServers": {
    "tool-poison-guard": {
      "command": "python",
      "args": ["-m", "mcp_tool_poison_guard"],
      "cwd": "/path/to/mcp-tool-poison-guard"
    }
  }
}
```

## Why entrepreneurs love this

- **Zero ongoing cost** – no OpenAI/Anthropic calls, pure Python heuristics
- **Enterprise-ready** – audit reports, risk scores, safe rewrites → easier security reviews
- **Protects your brand** – stops agents from leaking customer data or doing unauthorized actions
- **Fits Prevalid philosophy** – make AI accountable at the infrastructure level

## License

MIT

## Author

Prince Ruhul – Founder of Prevalid  
https://github.com/princeruhulofficial