auditing-mcp-servers-for-tool-poisoning

Audit MCP servers for tool poisoning, tool shadowing, rug pulls, SSRF, and unauthenticated exposure using Invariant Labs' mcp-scan for static/runtime scanning plus manual SSRF/auth checks and description pinning. Use before adding a new MCP server to an agent stack, when reviewing an internal MCP server, detecting rug pulls, or investigating an agent's unexpected tool-driven behavior.

Install

KitScout test notes

Not tested by KitScout yet. When our harness runs it, pros, cons and the tasks we tried appear here, with the date and evidence.

Similar tools

• ci-cd-and-automation 117,221 ★
  Automates CI/CD pipeline setup. Use when setting up or modifying build and deployment pipelines. Use when you
• shipping-and-launch 117,221 ★
  Prepares production launches. Use when preparing to deploy to production, or when asking what needs to be in p
• -21risk-automation 79,451 ★
  Automate 21risk tasks via Rube MCP (Composio). Always search tools first for current schemas.
• publish 70,897 ★
  Publish oh-my-opencode to npm by triggering the GitHub Actions publish workflow and verifying its artifacts. S
• modal 57,090 ★
  Modal is a serverless cloud platform for running Python on demand, including on-demand GPUs. Use when deployin