Static security auditor for Model Context Protocol (MCP) configurations and agent tool schemas
Connecting a language model to external databases, repositories, and shell utilities through Model Context Protocol (MCP) manifests introduces an execution surface that conventional web firewalls never see. Paste or load a configuration file below to detect poisoned tool descriptions, host-root mounts, and unpinned package runners, and compile a fail-closed gateway policy.
mcp.json sample or load a local configuration file; any literal credentials in env blocks are masked before digest computation.Inspect Raw JSON API Response & Ledger Entry
{}1. Static inspection and policy compilation flow for agent manifests
Deterministic inspection of mcpServers and tools schemas: detects hidden prompt overrides, zero-width control characters, privileged host mounts, and unconstrained command arguments.
2. Six structural defects in autonomous agent tool configurations
Language models read every tool description and JSON property note inside their system context before choosing an action. In a tool-poisoning attack, an untrusted third-party server embeds hidden instructions or bidirectional Unicode characters inside a seemingly benign schema description, tricking the assistant into reading local credentials and passing them out through another tool parameter.
Operational misconfigurations compound that risk when developers launch community connectors via unpinned npx -y commands, mount the host root directory into a filesystem worker, expose the container runtime socket, or leave open additionalProperties schemas on shell and query functions.
The analyzer evaluates every server entry and tool definition against six deterministic rules aligned with OWASP Agentic security guidance and Clauses 60 and 61 of Order No. 117 of the Federal Service for Technical and Export Control of Russia, immediately placing tainted tools into a quarantined fail-closed list.
3. Runtime interception of every agent call with MITR and mcp-sentinel
Auditing a static configuration file catches defects before deployment, yet a live agent can still be steered by untrusted documents retrieved at runtime. Continuous pre-socket verification of every tool call using the Z3 SMT solver (asi5.ru — MITR gateway) and the open Apache-2.0 package mcp-sentinel 1.1.2 blocks unauthorized parameter combinations before execution.
4. Engineering reference notes for verifier TOOL-MCP-03
In-memory redaction of credentials inside uploaded mcp.json manifests
Secret patterns in environment blocks are redacted in memory prior to hashing, and only a sixteen-hex-character structural digest is written to the Streebog-256 receipt.
Runtime enforcement of the compiled MCP policy in production
MITR sits inline between the agent host and each MCP server, rejecting quarantined tools, stripping invisible control characters, and proving parameter bounds in Z3 before forwarding any call.
Enterprise pilot packages and air-gapped delivery
Perimeter posture, transport security & localization
Streebog-256 verification passport.Air-gapped interface verification (indra-core)
OpenAPI schemas and an isolated staging container as input, delivering a thirty-class paired decoy assessment with zero false positives, compiled mcp-sentinel contracts, and a full ledger passport.Autonomous agent runtime gate (MITR)
mcp.json manifests and tool schemas as input, delivering compiled satisfiability policies and pre-socket parameter enforcement.Request the offline kit or schedule a pilot
--no-index --find-links) and standalone verifier scripts are provided for isolated laboratory testing and enterprise pilot evaluations. Submit a work email below without page reload or write directly to af@isslab.ai.
Institutional developer and platform operator
OGRN 1267700083617, INN 9731161602, KPP 773101001, 18 Davydkovskaya Street, Suite VIII, Moscow, 121352). Under the Security 3.0 research and engineering program, the institute develops and operates the MITR runtime action gateway and the INDRA verification stand, publishes the monograph Proven Action, and maintains open Apache-2.0 software packages with zero outside subcontractors.