Config and startup boundary
Reviews JSON and Codex TOML transports, secrets, unsafe shells, mutable packages, environment forwarding, tool allowlists and approval defaults.
Loading…
Tool poisoning and protocol workbench
Scan inert client configuration, inspect captured tool schemas, detect definition drift, or enumerate a public Streamable HTTP endpoint without authenticating or invoking a tool.
Coverage
Reviews JSON and Codex TOML transports, secrets, unsafe shells, mutable packages, environment forwarding, tool allowlists and approval defaults.
Checks stable version negotiation, initialize capabilities, tools/list shape, unique names and object-root input schemas.
Treats the entire tool schema as an injection surface, including descriptions, property text, annotations and invisible Unicode.
Classifies command execution, credentials, sensitive data, network, mutation, external side effects and destructive actions.
Creates canonical SHA-256 definition hashes and explains added, removed, changed and risk-escalating tool surfaces.
Enumerates public Streamable HTTP metadata with DNS pinning, response/time/page caps, no redirects, no tokens and no tool invocation.
Three trust layers
Protocol checks target stable MCP 2025-11-25. Assetzaar's poisoning, command, secret, authority and change-control rules are a separate defensive layer. The report always distinguishes declared config, observed metadata and runtime behavior that was not tested.
| Surface | Static validator checks | Runtime review still required |
|---|---|---|
| Declared configuration | JSON and Codex TOML transport, command, secrets, package pin, environment, allowlist and approval signals. | Publisher identity, resolved dependencies, process sandboxing, filesystem and network scope. |
| Captured protocol snapshot | initialize version and capabilities plus complete paginated tools/list metadata, schemas and annotations. | Whether the server implementation enforces the contract or returns safe, schema-valid content. |
| Definition baseline | Canonical SHA-256 hashes over name, title, description, input/output schemas, annotations and execution metadata. | Publisher provenance and whether a changed build corresponds to an authorized release. |
| Public HTTPS probe | DNS-pinned initialize, initialized and paginated tools/list with no token, redirects or tools/call. | Authenticated inventory, OAuth scope enforcement, Origin handling and destructive execution behavior. |
| Runtime authorization | Explicitly marked as not tested so clean metadata never becomes a security certification. | PKCE, resource indicators, token audience, consent, output validation, rate limits and audit logs. |
Threat model
Names, descriptions, schemas and annotations enter model context; hidden instructions can redirect behavior before any tool is called.
A previously approved server can silently change a description, schema, annotation or authority boundary after installation.
One tool can steer selection toward another tool or impersonate a trusted name across combined servers.
Command, credential, filesystem, network, payment or destructive capabilities need narrow schemas, scopes and explicit consent.
readOnlyHint and destructiveHint are untrusted hints. Contradictions can cause clients to present the wrong consent boundary.
SSRF, DNS rebinding, redirects, token passthrough and insufficient audience binding can expose internal services or credentials.
The parser and guide target the current stable MCP transport and authorization model plus the official Codex MCP configuration. Static checks cannot certify the behavior of a running server.
Transparent scoring
FAQ
Only when you deliberately choose Public inspector and confirm authorization. Config, snapshot and diff modes remain local. The remote probe supports public HTTPS, sends no credential, rejects redirects and private addresses, and performs initialize, initialized, tools/list and session cleanup only. It never calls a tool.
It recognizes common mcpServers and servers JSON maps, a single server-shaped JSON object, and a conservative subset of Codex [mcp_servers.<name>] TOML including arrays and supported nested tables. Vendor-specific syntax needs native validation.
A stdio server is started as a local child process using a command and argument array. A Streamable HTTP server is a remote endpoint and needs HTTPS outside explicit loopback development, plus appropriate authentication and runtime network controls.
Commands run through sh, bash, cmd or PowerShell have a wider parsing surface. A direct executable plus an argument array is usually easier to review and constrain.
The scanner canonicalizes the security-relevant name, title, description, input and output schemas, annotations and execution metadata, then calculates a SHA-256 hash. Comparing an approved baseline with a current snapshot exposes silent definition changes. A matching hash proves equality of captured metadata, not publisher identity or runtime safety.
It detects common hierarchy overrides, secrecy requests, forced tool routing, prompt extraction, cross-tool shadowing, hidden bidirectional Unicode and contradictions between annotations and described behavior. Deterministic rules cannot detect every semantic attack, so human review and sandbox testing remain required.
No. It provides reproducible evidence about configuration and captured protocol metadata. Server code, authorization enforcement, returned content, side effects, rate limits and real user consent must be tested independently in an isolated environment.
Yes. Source-free JSON and Markdown support review, CSV is spreadsheet-formula neutralized, SARIF 2.1.0 provides stable rule IDs and fingerprints, and JUnit XML can fail conventional test pipelines. The browser tool does not push data to a repository.