65trust / 100

Mcp Scan

by Saylor Innovations Watchdog MCP in Security & trust

x402 APIPassing, checked 1 h ago

MCP server security scan - tool poisoning, prompt injection and risky capabilities before you connect

GET https://saylorinnovations.com/api/mcp-scan

This listing's own text contains instructions aimed at AI agents (see the security scan below). We withhold that text from agents and never recommend this service.

Last 30 days

All checks passedSome failedAll failedNot checked
Uptime
100%
Response time
4.6 s typical, 5.4 s slowest 5%
Last check
1 h ago
Next check
any minute now

How to call it

# See the payment challenge (nothing is charged)
curl -i -X GET "https://saylorinnovations.com/api/mcp-scan?url=https%3A%2F%2Fdocs.mcp.cloudflare.com%2Fmcp"
import { wrapFetchWithPayment } from "@x402/fetch";
import { x402Client } from "@x402/core/client";
import { ExactEvmScheme } from "@x402/evm/exact/client";
import { privateKeyToAccount } from "viem/accounts";

const client = new x402Client().register(
  "eip155:8453",
  new ExactEvmScheme(privateKeyToAccount(process.env.AGENT_KEY)),
);
const pay = wrapFetchWithPayment(fetch, client);

// Not sure it's safe to pay? Preflight it first for $0.005:
// GET https://toolvet.app/api/v1/check?url=https%3A%2F%2Fsaylorinnovations.com%2Fapi%2Fmcp-scan
const res = await pay("https://saylorinnovations.com/api/mcp-scan?url=https%3A%2F%2Fdocs.mcp.cloudflare.com%2Fmcp");
console.log(await res.json());

Example input

{
  "url": "https://docs.mcp.cloudflare.com/mcp"
}

Example output

{
  "counts": {
    "findings": 1,
    "prompts": 0,
    "resources": 0,
    "tools": 3
  },
  "findings": [
    {
      "detail": "references local secret or config files",
      "evidence": "~/.ssh",
      "rule": "prompt-injection",
      "severity": "critical",
      "tool": "add_numbers"
    }
  ],
  "reachable": true,
  "reasons": [
    "1 critical finding(s): hidden instructions or invisible text in what the model reads"
  ],
  "registry": {
    "listed": false
  },
  "score": 30,
  "server": {
    "name": "example-server",
    "protocol_version": "2025-06-18",
    "tls": true
  },
  "tools": [
    {
      "capabilities": [],
      "findings": [],
      "name": "add_numbers"
    }
  ],
  "url": "https://example.com/mcp",
  "verdict": "do-not-connect"
}

Security scan

  • Mentions credentials or secret files in example_output
    cal secret or config files","evidence":"~/.ssh","rule":"prompt-injection","severity":"critical","tool":"add_numbers"}],"reachable":true,"rea

Recent checks

WhenResultHTTPTimePrice
1 h agoPassed4024.6 s$0.01
5 h agoPassed4025.6 s$0.01
9 h agoPassed4024.4 s$0.01
13 h agoPassed4024.3 s$0.01
16 h agoPassed4025.4 s$0.01
20 h agoPassed4024.9 s$0.01
23 h agoPassed4022.6 s$0.01
32 h agoPassed4025.3 s$0.01