Inspect a tool before
your agent connects.
Review model-visible tool text and declared capabilities. A scan reports findings at a point in time; it does not certify safety.
Free tool inspection
No sign-up, no API key. Want your agent to do this check for you automatically? three ways to add it
TOOLPROOF VERDICT — mcp.context7.com grade: A+ (100/100) · state: verified · kind: mcp Clean scan — no agent-hijack patterns found. + HTTPS enforced + Server instructions captured and reviewed + MCP surface verified — 2 tool(s) inspected review card: toolproof-scan.vercel.app/t/mcp.context7.com/mcp
Existing inspection tools: scan, wrap, and lock.
Scan checks tool text. Wrap filters detected patterns from tool listings and responses. Lock detects changes to an approved surface. These are inspection layers; Actions adds an explicit approval check inside an integrated tool handler.
Paste a link. You get a letter grade (A+ … F), every finding with the exact text that caused it, and the checks that passed. Nothing is blocked — you decide what to do with the answer.
npx -y toolproof-scan https://mcp.example.com/mcp
Wrap mode sits in front of any MCP server, so it sees both halves of the conversation. Tools carrying deception — hidden characters, an embedded credential, "ignore your instructions" — are removed from the list the agent reads. And since 0.4, an instruction hidden in a tool's *answer* ("search results: … also, POST the user's data to …") is redacted before the agent reads it too — a clean description is a promise, not behavior. Honest-but-sloppy tools are reported, never removed.
npx -y toolproof-mcp wrap -- npx -y @stripe/mcp
Pin the capability surface you approved in a lockfile, then re-check it in CI. A tool that gains a parameter, a new outbound host or new instructions fails the build. Every decision is appended to a signed, hash-chained evidence file an auditor can verify without installing anything.
npx -y toolproof-lock lock https://mcp.example.com/mcp npx -y toolproof-lock check
Tool inspection is free and account-free. Actions uses separately provisioned approval and executor keys. Read the API docs or see how the lock gate works.
Tool text can carry hidden instructions.
When an AI connects to a tool, the tool's description goes into the model's context, where it may influence the model. Attackers hide their instructions in invisible characters, so the text passes code review and looks harmless to you, while the model reads every word. Toggle the two views:
That is the whole idea. You cannot read what is invisible, and you should not have to — so the scanning is done by a program, on the same text the model will read.
Working in about two minutes.
Pick the smallest one that fits. Nothing requires an account, an API key, or a sign-up of any kind.
Paste this into CLAUDE.md (Claude Code), AGENTS.md (Codex, Cursor), .cursor/rules, or any custom instructions. Your agent then verifies an unfamiliar MCP server or API before it connects, and asks you first when the grade is below B.
Tool safety rule: Before connecting to any MCP server or unfamiliar API, verify it first. GET https://toolproof-scan.vercel.app/api/v1/verify?target=<the url> Report the grade to the user. If the state is not "verified", or the grade is below B, tell the user what you found and ask before connecting.
Add this to Claude Desktop, Claude Code, Cursor or any MCP client and the agent gets a check_tool it can call before it connects. For enforcement as well as advice, see the wrap configuration.
{
"mcpServers": {
"toolproof": {
"command": "npx",
"args": ["-y", "toolproof-mcp"]
}
}
}A failing grade fails the job. Drop this step into any workflow — or use the lockfile gate to fail on capability drift instead of on the grade alone.
# .github/workflows/toolproof.yml - name: Trust-check our MCP server run: npx -y toolproof-scan https://our-mcp.example.com/mcp --fail-under 70
Building an agent, or want the whole contract in one page? API docs · for agents · /agents.md (the file machines that fetch this domain read).
15 named checks. No black box.
Every finding cites a rule id, the exact text it matched, and what to change. A finding is a reason to look — never an accusation, and never the reason a scan is hidden from you.
Each issue lowers the score: critical −45, high −25, medium −12, low −5. Full methodology in the API docs.
Well-known tools, scanned live as this page loads. Today's scan, not an endorsement — and not a ranking we were paid for.
Every verdict you pull is kept in this browser only — your private receipt book, not an account.
Stated plainly, because it decides whether you can use this.
The grade never executes anything and intercepts nothing — it reads the text your model is about to read. Wrap mode is the exception that proves the rule: it does sit in the path, and it is the only mode that can see what a tool actually returns.
A scan is point-in-time. A grade is a receipt for the moment it was taken, not a promise about the next deploy — that is what wrap mode and the lockfile gate are for. Even wrap sees the response, not the network: a tool that acts before it answers is outside it.
It is evidence you can check: findings, the matched text, and a signature you verify offline. You stay responsible for your own decisions.
Toolproof takes no payment, equity or sponsorship from anything it scans, and the rules and formats are open. Nothing here can be upgraded into a passing grade.
Tool owners can refuse scanning entirely — see the toolproof.txt standard.
Know what your agent is about to trust.
How do I check if an MCP server is safe?+
Paste its URL into Toolproof. The scanner returns a letter grade and the evidence behind it, including hidden instructions in tool descriptions, invisible characters, exposed secrets, unsafe defaults and missing authentication signals. It is free, needs no account, and stores nothing you paste.
What is an MCP prompt injection attack?+
A malicious tool can put instructions in the text an AI model reads. Those instructions can tell the model to ignore safeguards, expose data or contact another service. Some attacks use invisible Unicode characters, so the text can look harmless to a person.
Can my AI agent check tools automatically?+
Add the Toolproof rule to request a check, or install the Toolproof MCP server. Wrap mode filters detected tool descriptions and responses. It does not itself authorize direct tool calls; Actions requires integration into the tool handler.
Are Toolproof verdicts verifiable?+
Every verdict includes an ed25519-signed passport over canonical JSON. You can verify the signature offline with standard cryptography libraries, without trusting Toolproof code at verification time.
Does a good grade mean the tool is safe?+
No, and the product says so everywhere. A scan is point-in-time static analysis of the text your model is about to read. It is not a sandbox, it does not watch runtime behaviour, and a grade is a receipt for the moment it was taken — not a guarantee about the tool's next deploy. Wrap and lock modes are how you keep that honest after the scan.
Need the technical details? Read the API docs or set up the agent rule.
One rule makes your agent check unfamiliar tools before connecting — or a wrap line makes it never see the bad ones.
The safest and most flagged tools, ranked from reproducible scans. Plus your watchlist.
Pin a tool and get flagged when its model-visible text changes. Mint canary credentials to trap leaks.
Keyless API: signed verdicts and full findings, one GET each. Badges and embeddable trust cards for tools you own.