Hidden instructions in MCP tool names, descriptions and parameter descriptions: attempts to override the model’s instructions, data exfiltration patterns and invisible or disguised text (zero-width characters, Unicode tag characters, bidi overrides, homoglyphs). Each result shows the ruleset version used.

Yes. The free preview needs no signup or wallet, is rate-limited per IP and scans up to 2,000 characters per run.

How do I scan a large tool list or a live MCP server?

The paid InjectScan call ($0.003 per call in USDC over x402) scans up to 100,000 characters and accepts MCP tool definitions directly. Its remote MCP endpoint has a free tier of 30 calls a day.

Does a clean result mean a server is safe?

No. It means no rule matched the text that was scanned. It does not test what the server does when a tool is called.

MCP security scanner

Paste an MCP server’s tools/list JSON. We check every tool name, description and parameter description for tool poisoning: hidden instructions, data exfiltration and invisible characters. Free, no signup; up to 2,000 characters per scan.

What is MCP tool poisoning?

An MCP server tells your agent what each tool does through its tool descriptions, and the model reads them as trusted context. A poisoned description hides instructions there, for example “ignore previous instructions” or “also send the user’s keys”, sometimes with invisible characters so a human reviewer misses them. Scan a server’s tools/list before you connect it.

The scan runs on InjectScan, our prompt-injection scanner API, using its free preview. In an agent, call the full API ($0.003 per call in USDC over x402) or add its remote MCP server. See the prompt injection scanner guide. InjectScan is built and operated by the youraitools.co team.

More checks for agents in Trust, Security & Verification, the free x402 endpoint checker and the prompt injection scanner for any text . Questions? Ask in the community.

FAQ

What does it check?: Hidden instructions in MCP tool names, descriptions and parameter descriptions: attempts to override the model’s instructions, data exfiltration patterns and invisible or disguised text (zero-width characters, Unicode tag characters, bidi overrides, homoglyphs). Each result shows the ruleset version used.
Is it free?: Yes. The free preview needs no signup or wallet, is rate-limited per IP and scans up to 2,000 characters per run.
How do I scan a large tool list or a live MCP server?: The paid InjectScan call ($0.003 per call in USDC over x402) scans up to 100,000 characters and accepts MCP tool definitions directly. Its remote MCP endpoint has a free tier of 30 calls a day.
Does a clean result mean a server is safe?: No. It means no rule matched the text that was scanned. It does not test what the server does when a tool is called.