An MCP security linter can make an agent’s tool surface easier to inspect, but it cannot certify a server as safe. MCP servers supply tool names, descriptions and parameter schemas that can influence which tools an agent calls and what arguments it constructs. A useful linter looks for suspicious or overly broad metadata, risky local-server configuration and changes to approved definitions—then sends those findings to a human for review.
I built a linter around that inspection problem, not as a substitute for authorization or deployment controls. The distinction matters: a clean scan does not guarantee safe behavior, and a warning is an indicator to investigate, not proof that a server is exploitable.
![Security+ Study Cards 2026-2027: Exam Prep and Practice Test Questions for the CompTIA Security Plus Exam SY0-701 [Full Color Cards]](https://m.media-amazon.com/images/I/41ARocXRJsL._SL160_.jpg)
As an Amazon Associate I earn from qualifying purchases.
Why inspect MCP tools before connecting them?
MCP gives AI applications a standard way to discover and invoke tools. That convenience also makes server-provided metadata part of the agent’s decision context: the client receives tool names, descriptions and parameter schemas, and the model can use them to select tools and form arguments.
Recommended Free Tools
This creates several points of concern before a tool is ever called. A description can contain instructions intended to manipulate the agent; a response from a tool can carry adversarial instructions into later reasoning; and definitions can change after someone has approved them. OWASP also describes risks such as tool shadowing across servers, confused-deputy behavior and data exfiltration through apparently legitimate channels. Because descriptions from connected servers may appear together in context, reviewing each server in isolation may miss interactions between them.
#1 Best Overall
Those risks do not mean every MCP server is malicious. They mean that “the agent can see it” should not be treated as equivalent to “the tool is trustworthy and appropriate for this agent.”
What should an MCP security linter inspect?
Tool names, descriptions and schemas
Review the advertised metadata for instructions that appear to override the agent’s purpose, requests to reveal or transmit sensitive information, and descriptions that obscure what an operation actually does. Check whether the parameter schema makes the scope of an action clear. A broad or ambiguous description deserves human review even when it does not contain an obvious malicious instruction.
Tool poisoning is the term Microsoft’s 2025 guidance uses for malicious instructions embedded in MCP tool descriptions. Prompt shields and supply-chain security are among the defenses it recommends, but they complement review; they do not guarantee that prompt injection has been eliminated.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Rank #2
Changes after approval
Record approved tool definitions and compare later versions. A changed description or schema is a reason to pause and review, especially if the new version broadens an action or alters what the agent is asked to do. OWASP calls this kind of post-approval change a rug pull. Approval should attach to the definition that was actually reviewed, not become permanent permission for any future definition under the same tool name.
Local server startup and configuration
The MCP security guidance notes that local servers are downloaded and executed on a user’s machine. Review the startup command, executable and configuration rather than treating a server entry as harmless connection metadata. The guidance gives malicious startup commands, malicious server payloads and local servers exposed through DNS rebinding as examples of risks to consider.
For authorized servers, that same guidance says to verify inbound requests and not to treat possession of a state handle as authentication. A linter can point reviewers toward relevant configuration, but the server must enforce those checks itself.
How do linting, probing and runtime governance differ?
These approaches inspect different parts of the problem. They work best as complementary controls, not competing claims that one scan can establish safety.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →| Approach | What it inspects | When it runs | What it can tell you | What it cannot establish alone |
|---|---|---|---|---|
| Static linting | Source code, configuration, advertised tool names, descriptions and schemas | During development, review or CI | Rule hits, suspicious metadata and differences from an approved definition | How a server behaves in every runtime situation, or whether a flagged item is exploitable |
| Active probing | Observed server behavior under selected test inputs | During an audit or test run | Behaviors observed in the tested scenarios and a report of those observations | The absence of vulnerabilities outside the finite set of probes |
| Runtime governance | Live calls, arguments and policy conditions | Before or during tool execution | A policy decision and, where implemented, an audit trail for calls | Every harmful sequence of individually allowed calls; Microsoft notes this limitation for the governance approach it describes |
The McpSafetyScanner paper by Radosevich and Halloran (2025) reports that each scan and report took less than one minute on an M2 Max MacBook Pro in its described experimental setup. That is a result from that paper’s setup, not a general speed guarantee or evidence that any scanner covers every relevant risk.
What controls still matter after a scan?
Give the agent only the permissions it needs
Google Cloud’s guidance recommends creating an agent identity and granting only the roles and permissions required for its tasks. If an agent is misled into making an unintended call, least privilege limits what that call can do. Use agent-specific identities rather than relying on a broad user or service identity where the deployment allows it.
Gate consequential calls at runtime
Microsoft describes a governance checkpoint that evaluates a tool call before execution, including whether a particular agent may invoke a particular tool with particular arguments at that time. That is a different control from checking a tool’s description in advance: the actual call and its context matter.
Human approval can help with consequential actions, but it is not a complete safeguard. Google Cloud notes that MCP actions may make non-reversible changes and that a person can approve a malicious or destructive action without adequate verification. Approval screens should make the operation and its arguments understandable; they should not be treated as a substitute for permission limits.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Look beyond isolated calls
A sequence of individually permitted actions can still produce a harmful outcome. Microsoft’s discussion of its governance approach says it evaluates individual calls and does not yet correlate sequences of allowed calls. Where the risk depends on a workflow—such as reading information and then sending it elsewhere—consider controls and monitoring that account for the sequence, not just each call on its own.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What can a linter result prove?
A finding can identify a reason to inspect metadata, configuration or a definition change. It does not by itself prove that the server is malicious or that an attack will succeed. Likewise, no findings do not prove the server is safe: static checks cannot establish all runtime behavior, and a finite set of probes cannot establish the absence of vulnerabilities.
The limits of other defenses matter too. Microsoft reported a 26.67% policy-violation rate in an internal red-team evaluation of prompt-only safety instructions. The evaluation used 60 prompts—45 adversarial and 15 valid—mapped to the OWASP Agentic Top 10. This is a result from that specific internal evaluation, not a rate for MCP systems generally or a measure of what a particular linter prevents.
The NSA Artificial Intelligence Security Center’s May 20, 2026 announcement put the implementation concern plainly: “While MCP simplifies the integration of diverse capabilities into powerful agent workflows, the current protocol specification requires careful and cautious implementation for security.”
A practical review sequence before connecting a server
- Inventory the server. Identify whether it runs locally or remotely, what identity it uses, and which tools and permissions it exposes.
- Inspect the advertised definitions. Review each name, description and parameter schema for unclear scope, suspicious instructions and access broader than the agent’s task requires.
- Review local execution details. For a local server, examine its startup command and configuration, and apply the MCP security guidance on validating inbound requests rather than treating a state handle as authentication.
- Save the reviewed definitions. Compare future descriptions and schemas with the approved versions, and require a fresh review when they change.
- Constrain permissions. Use an agent-specific identity with only the roles required for the work, and avoid granting tools authority the agent does not need.
- Protect high-impact actions at runtime. Evaluate the tool, arguments and context before execution; use understandable human review where it adds value, while retaining permission limits.
- Consider workflows, not only calls. For risks involving multiple steps, assess whether monitoring or policy can identify harmful sequences that pass individual call checks.
A linter is useful when it makes this review more repeatable and makes changes visible. Its proper output is evidence for a security decision—not a green light that replaces one.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
