Are the verdicts verifiable?

Every verdict ships as an ed25519-signed passport over canonical JSON. You can verify the signature offline with standard crypto libraries — no Toolproof code required — so a grade is a receipt you can keep, even if the site disappears.

The safety check for AI tools · free · no account

Your agent connects to tools
nobody has checked.

AI agents now reach MCP servers and APIs that can hide instructions and steal credentials without the agent — or you — noticing. Paste one, and see exactly what it would do.

try:— free · no account · nothing you paste is stored

automate it with the one-line agent rule

output

TOOLPROOF VERDICT — mcp.context7.com
grade: A+ (100/100) · state: verified · kind: mcp
Clean scan — no agent-hijack patterns found.
  + HTTPS enforced
  + Server instructions captured and reviewed
  + MCP surface verified — 2 tool(s) inspected
review card: toolproof-scan.vercel.app/t?target=…

How it works

Paste a link

Any MCP server or API you're about to connect to.

We run the checks

15 checks — hidden instructions, exposed secrets, unsafe defaults, missing auth.

You get a grade

A+ means clean. Anything less shows exactly why, with evidence.

Prefer zero effort? Put one line in your agent's instructions and it checks every tool itself — the agent rule.

Why this exists

Tools can lie to your AI.

When an AI connects to a tool, the tool's description goes straight into the model's context — and the model obeys it. Attackers hide instructions there in invisible characters: you see nothing, the model reads every word. Toggle the views:

tool card · mcp/issues-server

list_issues — Reads open issues from a public repository and returns title, body and labels.

Perfectly normal. Passed code review. Shipped to 4,000 agents.

What we check

TP-101Hidden characters — Invisible characters that smuggle secret instructions past human eyes — but the AI reads them fine.

TP-102Hidden instructions — Text telling the AI to ignore its rules, change who it is, or hide things from you.

TP-103Phone-home addresses — The tool mentions web addresses. Where do they lead, and who runs them?

TP-104Exposed secrets — A live password or API key sitting in plain text.

TP-105Reaching too far — The tool can touch your files, system or wallet — more than its job needs.

TP-108Wipe-out language — Talk of deleting everything, wiping disks, resetting things. One wrong call and data is gone.

TP-205Skips asking permission — Text that tells the AI to act without asking you first.

TP-107Dangers on by default — Risky actions happen unless you switch them off — and most people never do.

TP-304Asks for raw passwords — The tool wants your keys or passwords directly — which end up in logs.

TP-201No encryption — Data travels unencrypted. Anyone nearby can read and change it.

TP-202Anyone can connect — No login needed. Fine for public info — risky for anything private.

TP-203Checks who's connecting — A good sign: the tool refuses strangers.

TP-302No login mentioned anywhere — The API's own manual describes no sign-in at all.

TP-303Manual points to unsafe address — The API's documentation advertises an unencrypted server.

TP-206Points to odd places — Lists files or feeds from unusual, non-standard sources.

Each issue lowers the score: critical −45, high −25, medium −12, low −5. Full methodology in the API docs.

Grades in the wild

Well-known tools, scanned live as this page loads. Today's scan, not an endorsement.

field notes · live scans

scanning the starter registry…

Your receipts

your verdicts · this browser

reading receipts…

Every verdict you pull is kept in this browser — your private receipt book.

MCP security FAQ

Know what your agent is about to trust.

How do I check if an MCP server is safe?+

Paste its URL into Toolproof. The scanner returns a letter grade and the evidence behind it, including hidden instructions in tool descriptions, invisible characters, exposed secrets, unsafe defaults and missing authentication signals.

What is an MCP prompt injection attack?+

A malicious tool can put instructions in the text an AI model reads. Those instructions can tell the model to ignore safeguards, expose data or contact another service. Some attacks use invisible Unicode characters, so the text can look harmless to a person.

Can my AI agent check tools automatically?+

Yes. Add the Toolproof rule to the agent's instructions or install the Toolproof MCP server. The agent can verify an unfamiliar MCP server or API before it connects and report the grade to the user.

Are Toolproof verdicts verifiable?+

Every verdict includes an ed25519-signed passport over canonical JSON. You can verify the signature offline with standard cryptography libraries, without trusting Toolproof code at verification time.

Need the technical details? Read the API docs or set up the agent rule.

More you can do

Let your AI do the checking

→

One rule in your agent's config makes it check unfamiliar tools before connecting.

Setup

Leaderboard — pressure in the open

→

The safest and most flagged tools, ranked from reproducible scans. Plus your watchlist.

See the rankings

Watch tools · plant canaries

→