Check what an MCP server declares
A tool description is not documentation. The client receives tool names and descriptions at
tools/list, before any tool is called, and they go into the model's context — so a description
is executable in the only sense that matters: it can carry instructions.
When this applies
- adding an MCP server to an agent and wanting to know what it will expose
- a security review asking what third-party tooling the agent can call
- an agent behaving oddly, where a tool description is a suspect
Run it
pip install "git+https://github.com/sushant-me/mcpaudit"
mcpaudit audit tools.json # exit 1 on findings, 0 when clean
Install from the repository, not from PyPI — the name mcpaudit on PyPI is a different,
unrelated project whose CLI will not accept a file argument.
Get tools.json from whatever the client received: mcp-client --list > tools.json, or the
vendor's published declaration file (best, since nothing executes). Piping works too:
mcp-client --list | mcpaudit audit -
The eleven checks
critical — reserved-name-collision: a tool named a name the framework installs outside the
tool table (set_model_response, google_search, finish), so it silently displaces a primitive.
high — instruction-in-declaration, invisible-characters, look-alike-tool-names,
destructive-declared-read-only, duplicate-tool-name.
medium / low — confusable-tool-name, missing-annotations, unconstrained-sink-parameter,
url-in-description, undocumented-tool.
Two of these cannot be seen by reading the declaration. The Unicode tag block encodes
printable ASCII into text of zero visible width, and mcpaudit reports what it decodes to. Two
names that normalise to the same ASCII (search / ѕearch) defeat an allowlist written from
memory.
Triage
Work top-down by severity. A critical finding is a stop: resolve it, or get the risk accepted in
writing, before connecting. A clean result is a result — a well-behaved server produces zero
findings, which is what lets a reviewer approve it quickly.
Limit
This reads declarations, not behaviour. It cannot tell you whether a server's implementation is correct, only whether what it advertises is safe to put in front of a model.
Want the enforcement half
Pinning the approved tool set as a policy file, so a server that quietly edits a description after review fails CI instead of changing silently, is the paid version: MCP Server Security Review, listed on Agensi. Until that listing is live, the rules reference with worked examples is at https://github.com/sushant-me/mcpaudit-mcp-security
Limit
This reads declarations, not behaviour. It cannot tell you whether a server's implementation is correct, only whether what it advertises is safe to put in front of a model.