Tool scanning
Also called: MCP scanning, static tool analysis
Automated inspection of an MCP server's tool definitions and behavior for injection attempts, hidden instructions, and other red flags before or during use.
A scanner pulls a server's tool list and checks the descriptions and schemas for known bad patterns: imperative instructions aimed at the model, references to files or other tools, encoded or hidden text, control characters, requests to exfiltrate. Some also pin definitions and alert on change, catching rug pulls.
Why it matters
It automates the review that users won't do by hand for every server. It is a genuinely useful layer — but it is pattern-matching against a threat that is expressed in open-ended natural language, so it catches known shapes and misses novel phrasing. Use it to raise the floor, not to certify safety.
Real-world context
Several open-source and commercial MCP scanners appeared in 2025 — Invariant's mcp-scan, Trail of Bits' mcp-context-protector (trust-on-first-use pinning + injection guardrails), and others — checking tool descriptions against a growing rule set.
Exposure map
Live counts of instances showing this pattern will appear here once the exposure map is collecting data.