tamish560/mcprobe

mcprobe is a command line security tool for checking MCP servers, which are the plug-in style services that AI agents connect to for extra tools and abilities, before you trust them with access to your files or shell. The author's argument is that people connect these servers to their AI agents without checking what is actually inside them first, and mcprobe fills that gap by reading every tool description, schema, and resource link a server exposes and flagging anything suspicious. The tool ships as a single binary with no outside dependencies, built entirely with Go's standard library. It checks for several specific problems: hidden prompt injection text buried in a tool's description that could trick an AI model into following unintended instructions, two servers claiming the same tool name so the agent cannot tell which one it is really calling, tools that ask for access to sensitive files like SSH keys or environment files, path patterns that could let a tool escape its intended folder, descriptions that are unusually long and might be hiding something, and tools with missing descriptions that force the model to guess what they do. You can scan a server connected over standard input and output, an npm package, an HTTP endpoint, or a server sent events endpoint. It can also save a snapshot of what a server looks like today and later compare against that snapshot to detect if the server has quietly changed, for example if a tool's description was rewritten after the fact. Results can be printed as readable text, structured JSON, or the SARIF format used by many continuous integration systems, and the tool exits with a specific code depending on how risky its findings are. It can be installed directly through Go's install command, built from source, or downloaded as a prebuilt binary from the project's releases page. The project is released under the MIT license.