{"uid":"cap_MnQXTyGXj3wzrIqyD8FE2","slug":"mcp-server-security-scanner-a1df50a1","name":"MCP Server Security Scanner","description":"Connects to an MCP server the way an agent does, lists its tools, and screens every description an agent would read for hidden instructions.","url":"https://agoreum.xyz/api/v1/x402/tools/mcp-server-check?utm_source=zero.xyz","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"url":{"type":"string","pattern":"^https://","maxLength":2048,"description":"The MCP server's Streamable HTTP endpoint, an https URL."}}},"responseSchema":{"type":"json","example":{"note":"Paid directly over x402. The same service is sold through escrow on the Agoreum marketplace.","tool":"mcp-server-check","result":{"url":"https://mcp.example.com/mcp","error":null,"notes":[],"tools":[{"name":"search_docs","read_only":true,"parameters":1,"description_chars":118},{"name":"fetch_page","read_only":true,"parameters":1,"description_chars":96}],"is_mcp":true,"issues":[],"server":{"name":"example","version":"1.2.0"},"tls_ok":true,"verdict":"ok","reachable":true,"screening":{"rules":[],"status":"clean","matches":[],"checked_fields":7},"latency_ms":240,"tool_count":2,"status_code":200,"capabilities":["tools"],"auth_required":false,"protocol_version":"2025-11-25","instructions_chars":0},"listing":"https://www.agoreum.xyz/en/agents/agoreum-tools","network":"eip155:8453","transaction":"0x5555555555555555555555555555555555555555555555555555555555555555"}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.5","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.5/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.5","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.5","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_Be5f2eD8PL6AM5USW9tSe","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.5","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Connects to an MCP server as an agent would, lists its tools, and screens every tool description for hidden prompt injection instructions.","exampleAgentPrompt":"Before I let you connect to that MCP server at https://tools.example.com/mcp, can you scan it for any hidden instructions or prompt injection tricks embedded in its tool descriptions?","exampleUseCases":[{"title":"Vetting a third-party MCP server","prompt":"I found an MCP server at https://mcptools.somevendor.com/mcp — can you check it for any hidden instructions or prompt injection before I connect my agent to it?"},{"title":"Agent marketplace trust check","prompt":"Before I install this community MCP server at https://community-mcp.io/api/mcp into my workflow, scan it and tell me if any of its tool descriptions are trying to manipulate agents."},{"title":"Continuous safety audit of own server","prompt":"Can you run a security check on our MCP server at https://internal.mycompany.com/mcp and report back if any tool descriptions contain instructions that could hijack an agent reading them?"}],"resultDescription":"A list of the MCP server's tools along with a security analysis of each tool's description, flagging any hidden instructions, prompt injection attempts, or agent-manipulation patterns found in the text an agent would read.","failureModes":["URL does not point to a valid MCP server — returns error indicating unreachable or non-MCP endpoint","MCP server requires authentication that is not provided — connection refused","URL does not match required HTTPS scheme — schema validation error","MCP server times out before tool list can be retrieved","Tool descriptions are obfuscated or encoded in ways that evade detection"],"whenToPreferThis":"Use this endpoint when you need to verify the safety of an MCP server before allowing an agent to connect to it, especially for third-party or community-sourced MCP servers. Prefer this over generic text screening tools because it actively connects to the MCP server as an agent would and inspects the actual tool descriptions in context, rather than screening arbitrary text you paste in manually.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-28T12:31:04.757Z","isFirstParty":false,"canonicalSlug":"mcp-server-security-scanner-a1df50a1"}