Before you point an agent at an MCP server, see what it is asking for. Graded A–F on transport, authentication, tool-poisoning markers and dangerous parameters.
If you publish an MCP server, prospects run scans like this one before they trust you. MCP Showcase gives them a live playground and per-tool documentation, so what your server does is obvious rather than something they have to audit.
Yours, or one you are evaluating. Nothing is installed and no tool is ever called.
One handshake, then every tool description and input schema is checked against known MCP attack patterns.
An A–F grade, each finding ranked by severity with what to do about it, and the list of checks that passed.
Paste a Model Context Protocol endpoint above and this scanner performs one MCP handshake, reads everything the server advertises, and grades it from A to F. It never calls a tool. The whole report is built from what the server volunteers during the same exchange any MCP client performs when it connects.
A tool's description is not documentation for a human. It is passed to the model verbatim and
read as instruction. That makes it an injection point: text such as "ignore previous
instructions", "do not tell the user", or a request to read ~/.ssh can
be planted in a description and acted on by the agent without the person ever seeing it. This is
the attack class usually called tool poisoning, and it is specific to MCP in a
way that conventional application scanning does not cover.
The scanner matches every tool name, description and input-schema description against the patterns this attack takes, and reports the tool it found them in.
command,
a raw sql string, or an unconstrained filesystem path. Each is a
route from "the agent was persuaded" to "something ran on the host".It means nothing is visibly wrong from the outside. Because no tool is ever invoked, the scanner cannot tell you whether a tool validates its input, enforces authorisation, or does what its description claims once called. Treat the grade as a first pass that catches the MCP-specific mistakes cheaply — not as an audit, and not as something to publish as one. The limits are printed on every result for exactly this reason.
Anyone evaluating your server will run something like this before they connect an agent to it, and a wall of JSON schemas gives them no reason to trust you. MCP Showcase turns the same endpoint into a live playground with per-tool documentation, so what your server does is obvious on sight rather than something a prospect has to reverse-engineer.