# MCP Tool Schema Scanner Paste your MCP server's tools/list response and see which lines of each tool schema allow path traversal, SSRF, or injection. Three annotated examples included. Runs in your browser; nothing is uploaded.
2,432 of 8,216 MCP servers expose high-risk inputs with zero validation →

Is your MCP server secure?

Click an example to see exactly which lines of a tool schema create real vulnerabilities — and which ones prevent them.

Check your own server

Paste the tools array from your MCP server's tools/list response. — 100% client-side, nothing leaves your browser.

What MCP security vulnerabilities look like

MCP servers expose tools that AI agents call autonomously. Every tool parameter is an attack surface — if the schema doesn't constrain it, the agent (or an attacker manipulating the agent) can exploit it.

Path Traversal

A path parameter with no pattern constraint lets an agent read ../../etc/passwd or overwrite system files.

SSRF

A url parameter without validation can target http://169.254.169.254 (cloud metadata) or internal services.

Injection

Parameters named query or command that accept arbitrary strings are injection vectors. Use enums and parameterized queries.

Destructive Ops

Tools named delete or drop without authorization controls let any agent permanently erase data.

How to get your tools/list response

curl (Streamable HTTP servers)

curl -s -X POST https://your-mcp-server/endpoint \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' \
  | jq '.result.tools'

MCP Inspector — connect to any server, click "List Tools", copy the JSON.

Client logs — Claude Desktop, Cursor, and Cline all log tools/list responses.

Fix the schema. Then control the call.

A constrained schema limits what a tool accepts. ACP limits what the agent is allowed to call: a hook in the agent harness sends every tool call, MCP or built-in, to the gateway before it runs. The gateway records it, applies your rules per tool and per agent tier, and returns allow, flag, ask, or deny. No server code changes. One command installs it for Claude Code, Cursor, Codex, and OpenClaw: 

curl -sf https://agenticcontrolplane.com/install.sh | bash

Windows — in PowerShell: irm https://agenticcontrolplane.com/install.ps1 | iex

Try ACP free ACP for coding agents → Read the security checklist