Toolprooffor agents
you're right — nobody scans anything

Don't come here at all.
Make your AI do the checking.

Your AI is the one connecting to tools, so your AI is the one who should check them. Add this one rule, and it can verify unfamiliar MCP servers or APIs before it connects.

one rule, nothing to install

Paste this into your AI's instructions.

Works in CLAUDE.md (Claude Code), AGENTS.md (Codex, Cursor), .cursor/rules, or any custom instructions / system prompt. After this, your AI verifies every tool before it connects.

the rule
Tool safety rule:
Before connecting to any MCP server or unfamiliar API, verify it first.
GET https://toolproof-scan.vercel.app/api/v1/verify?target=<the url>
Report the grade to the user. If the state is not "verified", or the
grade is below B, tell the user what you found and ask before connecting.
for agent developers

One GET per verdict.

The API is open, keyless and cache-friendly: /api/v1/verify?target=… returns a signed passport; /api/v1/scan?target=… returns full findings. Machines that fetch this domain read the same rules at /agents.md. Full contract in the API docs.

native MCP tool

Give every MCP client a preflight check.

toolproof-mcp exposes check_tool and lookup_rule over stdio. Add this configuration to Claude Desktop, Claude Code, Cursor, or another MCP client; the scanner then checks a tool before an agent connects.

MCP configuration
{
  "mcpServers": {
    "toolproof": {
      "command": "npx",
      "args": ["-y", "toolproof-mcp"]
    }
  }
}