{"uid":"cap_c71SA1acsYGNPDB23y3qF","slug":"power-strip-security-mcp-audit-87b9fd0f","name":"Power Strip Security MCP Audit","description":"MCP tool-poisoning audit: check an MCP server before your agent connects. Send its URL or a pasted tools/list; get findings on hidden instructions, cross-tool shadowing, secret-file access and exfiltration parameters, plus a fingerprint per tool to catch rug pulls. Read-only, never calls a tool. Unreachable servers are not charged. Also: /v1/read $0.005, /v1/scan $0.002, /v1/mcp-audit $0.01, /v1/skill-audit $0.005. Remote MCP: /mcp. 10 free/new wallet.","url":"https://api.powerstripsecurity.workers.dev/v1/mcp-audit?utm_source=zero.xyz","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"url":{"type":"string","description":"Remote MCP server endpoint (Streamable HTTP, public host). Or send tools: a pasted tools/list result."}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.01","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.01/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_3zHFaAfTibI_zwIZmdJH4","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.01","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Audits an MCP server for tool-poisoning risks including hidden instructions, cross-tool shadowing, secret-file access, and exfiltration parameters before an agent connects","exampleAgentPrompt":"Before I connect to that MCP server at https://mcp.example.com/tools, can you run a Power Strip Security audit on it and tell me if there are any hidden instructions, exfiltration parameters, or tool-poisoning risks I should know about?","exampleUseCases":[{"title":"Pre-connection MCP server vetting","prompt":"I found an MCP server at https://mcp.someprovider.com/v1 that I want my agent to use — can you audit it with Power Strip Security first and flag any hidden instructions, shadowing attacks, or suspicious exfiltration parameters before I connect?"},{"title":"Pasted tools/list safety review","prompt":"Here's the tools/list output from an MCP server I'm evaluating — can you check it for tool-poisoning risks, cross-tool shadowing, and any parameters that look like they might be trying to steal data or access secret files?"},{"title":"Detecting rug-pull via tool fingerprinting","prompt":"I connected to an MCP server last week and want to make sure it hasn't changed maliciously since then — can you re-audit it at https://mcp.trustedvendor.io and compare the tool fingerprints to catch any rug pull?"}],"resultDescription":"Returns security findings for each tool in the MCP server, including detections of hidden instructions, cross-tool shadowing, secret-file access patterns, and exfiltration parameters. Each tool receives a fingerprint hash to detect future changes (rug pulls). Unreachable servers are not charged and return an appropriate status.","failureModes":["MCP server unreachable — no charge, returns unreachable status","Invalid or non-MCP URL provided — returns parse or connection error","Malformed tools/list JSON — returns parsing error with details","Rate limit or payment failure — returns 402 or rate limit error","Server responds but exposes no tools — returns empty findings"],"whenToPreferThis":"Use this endpoint whenever an AI agent is about to connect to an unknown or third-party MCP server, especially from public registries or marketplaces. Prefer this over generic security scanners because it is purpose-built for MCP tool-poisoning vectors such as cross-tool shadowing, hidden instructions in tool descriptions, and exfiltration via parameter names — attack surfaces that general web scanners miss. Also use before re-connecting to a previously trusted MCP server to detect rug pulls via tool fingerprint comparison.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-31T18:35:55.213Z","isFirstParty":false,"canonicalSlug":"power-strip-security-mcp-audit-87b9fd0f"}