Skip to content
Get packs

MCP Tool-Poisoning Auditor

Audits MCP servers for poisoned tool descriptions, rug pulls, SSRF and missing auth before you trust them.

Source Download skill
Repository
mukul975/Anthropic-Cybersecurity-Skills
Stars
35,430
Licence
Apache-2.0
Files
4 files

What it does

Once installed, the agent walks you through checking an MCP server (a plugin-style tool provider for AI agents) before you connect it to your agent. It runs Invariant Labs' mcp-scan on your config, reads tool descriptions for hidden instructions, pins tool hashes to catch silent changes after approval, and offers manual checks for SSRF and authentication. A bundled Python script runs a static config scan and a heuristic check of a stdio server's tool descriptions.

Great for

  • Security or platform engineers vetting a third-party MCP server before adding it to an agent stack
  • Developers reviewing an internal MCP server they are building
  • Teams wanting a CI gate that rescans MCP configs on each change

Skip it if

  • Auditing servers you do not own or have written permission to test: active probing for SSRF or auth weaknesses can be illegal and can disrupt systems
  • Anyone expecting a complete guarantee: the heuristic regex patterns can miss novel or obfuscated attacks, so a clean result is not proof of safety

Try asking

  • “Audit the MCP servers in my ~/.cursor/mcp.json for tool poisoning before I enable them”
  • “Check whether any tool description on this internal MCP server has changed since last week”
  • “Enumerate the tools of ./suspect-mcp-server.js and flag hidden instructions in their descriptions”
  • “Review whether my URL-fetching MCP tool is vulnerable to SSRF on a server I own”
Step-by-step guide: how to use MCP Tool-Poisoning AuditorInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 4 original files, the Apache-2.0 licence and an attribution note.

    auditing-mcp-servers-for-tool-poisoning.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip auditing-mcp-servers-for-tool-poisoning.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip auditing-mcp-servers-for-tool-poisoning.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Read the scanned tool descriptions yourself and treat them as untrusted input; do not load an unaudited MCP server into a privileged agent.
  • Run scans on a schedule so hash mismatches on previously approved tools are caught as rug pulls.
  • Review scripts/agent.py before running it, since it launches the MCP server command you give it and calls external tools such as uvx.

What's inside

  • references/api-reference.md
  • references/standards.md
  • scripts/agent.py
  • SKILL.md

Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.