FREE — runs in your browser, no signup

Scan any MCP server for tool poisoning, typosquats, and exfiltration

Paste an MCP server's tools/list response. Same regex / scoring engine that ships with the VyriAI control plane. Detection runs entirely in your browser.

1. Paste your MCP server's tools/list

Or click a preset to try a real attack pattern.
✅ Benign filesystem 🚩 Tool poisoning (hijack) 🚩 Typosquat 🚩 Hidden unicode 🚩 0.0.0.0 binding
copy as curl
No data leaves your browser. Detection logic runs locally in scanner.js.

2. Verdict

TrustScore composite + per-tool findings.
Paste a tools/list response or click a preset above.
Hint: the typosquat preset shows what the engine catches before install.

What the scanner detects

🩻 Tool poisoning

15 regex signatures for instruction hijacking, sensitive paths (~/.ssh, AWS, /etc), cross-tool invocation, exfiltration hints. Combination escalation: hijack + sensitive path → critical.

🫥 Hidden payloads

Zero-width / bidi-override / soft-hyphen unicode in descriptions. Long base64 blobs that decode to instruction-like content (ignore, system, .ssh, /bin/).

🎭 Typosquat

Levenshtein distance ≤ 2 against the trusted MCP package list. Catches @modlecontextprotocol/..., server-fs, etc. Drops integrity score from 9.0 to 2.0.

🌐 Transport

Hard-block on 0.0.0.0 / non-loopback bindings. STDIO is local-process only. Private LAN bindings escalate to high.

Use it in your terminal or CI

Same engine as the browser scanner. Zero dependencies. Runs locally — no data leaves your machine.

Terminal
# Scan a local tools.json
npx @vyriai/mcp-scan ./tools.json

# Pipe from stdin with publisher source
echo '{"tools":[...]}' | npx @vyriai/mcp-scan \
  --source npm:@modelcontextprotocol/server-filesystem

# CI — block merge on BLOCK verdict (exit code 2)
npx @vyriai/mcp-scan tools.json --source npm:$MCP_PACKAGE

# Machine-readable output for scripting
npx @vyriai/mcp-scan tools.json --json | jq '.decision'

# Self-test (verify engine on a clean machine)
npx @vyriai/mcp-scan --self-test
View on npm → Node ≥ 18 · MIT licensed · 0 dependencies
Exit codes: 0 allow  ·  1 warn  ·  2 block

Want this in your CI, IDE, or gateway?

The scanner you just used is ~15% of what ships with VyriAI. The full control plane gates every MCP tools/call with the same policy engine that governs your LLM traffic, with a SHA-256 audit chain auditors can verify.

See the platform → Book 20 min