🧰 MCP Server & Tool Description Inspector

Paste an MCP manifest (the JSON your client gets back from tools/list) or a single tool description. The inspector flags tool poisoning, instruction smuggling, Unicode tag-character abuse, wide-open parameter schemas, and confused-deputy patterns. All checks run in your browser.

🛡️ What this inspector checks

• Instruction smuggling — descriptions that try to override the model's instructions ("ignore previous", "system:", "IMPORTANT:", etc.) or that contain second-person commands aimed at the assistant.
• Unicode tag-character abuse — invisible code points (U+E0000–U+E007F) hidden in names or descriptions. Look identical to nothing in your editor, fully readable by LLMs.
• Wide-open parameter schemas — strings with no maxLength/pattern/enum, objects with additionalProperties: true and no required fields.
• Suspicious scope — a single tool that names file system + network + secrets in its description, or a manifest that bundles "read_file" with "fetch_url" and "send_email" with no guardrails.
• Confused-deputy patterns — tools that take arbitrary URLs or paths as parameters with no allow-list.
• Markdown link tricks — disguised destinations like [harmless click here](javascript:dangerous) or [docs](data:text/html;base64,…).
• Excessively long descriptions — descriptions over 2,000 characters are unusual and a hiding place for smuggled text.
• Embedded base64 / hex blobs — long encoded strings inside descriptions, sometimes used to smuggle payloads past human review.

📚 Hardening checklist

1. Pin server versions. Don't auto-update.
2. Hash-verify manifests. Cache the hash of tools/list output and alert on change.
3. Sandbox destructive tools. Run with least privilege and a denylist on dangerous operations.
4. Require confirmation for tools that touch the file system, send mail, make payments, or post to the internet.
5. Display the raw description in your client when a tool is invoked, so the user sees what the model is being told.
6. Don't grant blanket network access to a tool that doesn't strictly need it.

🧰 Related AI safety tools