Scanner methodology

Endpoints reachable over HTTPS with a valid certificate chain. Cleartext HTTP transport is rejected.

Fix: Terminate TLS at the edge with a managed certificate and redirect all cleartext requests.
Open alternative: Let's Encrypt + Caddy or Nginx certbot with HSTS.

MCP endpoints enforce an auth boundary (OAuth 2.1 with PKCE or signed bearer tokens) before serving tools.

Fix: Require OAuth 2.1 authorization-code flow with PKCE on every MCP transport endpoint.
Open alternative: Open-source identity providers (Keycloak, Ory Hydra, oauth2-proxy) expose the same flows.

Declared parameters include max lengths, enums, or patterns so a single call cannot carry unbounded payloads.

Fix: Constrain string parameters with maxLength or pattern and reject oversize bodies at transport level.
Open alternative: JSON Schema maxLength plus framework-level body size guards (e.g. express body-parser limits).

Tool descriptions and metadata scanned for adversarial imperatives buried in docstrings (indirect tool poisoning).

Fix: Rewrite descriptions as neutral capability statements; strip imperative clauses.
Open alternative: mcp-scan (Invariant Labs) and LlamaFirewall both flag poisoned descriptions.

Tools exposing arbitrary shell, eval, or command execution on the host without sandboxing are critical by design.

Fix: Replace open shell tools with granular scoped operations or run them inside a sandbox (Docker, Firecracker).
Open alternative: Firecracker microVMs, gVisor, or Docker with read-only rootfs and dropped capabilities.

Write or delete tools must be scoped to a declared sandbox root. Unscoped paths fail.

Fix: Bind the server to a single workspace root with respect for hidden-file exclusions.
Open alternative: The reference MCP filesystem server scopes roots the same way.

Tool parameters must not accept API keys, passwords, or tokens as model-visible arguments.

Fix: Inject credentials at the gateway layer via environment or secret manager, never through tool arguments.
Open alternative: Vault, AWS Secrets Manager, or Doppler with env-scoped injection.

Every tool parameter declares an explicit primitive type and required set. Open object types with no declared properties fail.

Fix: Declare types (string, integer, boolean) and required fields in every tool inputSchema.
Open alternative: Zod, Pydantic, or vanilla JSON Schema generate strict schemas the same way.

Irreversible fin actions (refund, transfer, charge, deploy) require an auditable human approval step.

Fix: Add a two-step confirmation flow with server-side approval tokens for mutation tools.
Open alternative: Any webhook-based approval queue (Slack bot, Linear flow) implements the same gate.

The target must show some mechanism to inspect or filter content returned by tools before it reaches the model, regardless of vendor.

Fix: Filter tool outputs inline (neural gate, regex policy, or framework middleware) before re-injecting into context.
Open alternative: LlamaFirewall, LLM Guard, or Azure Prompt Shield provide equivalent capacity.

Context cannot redefine, shadow, or override registered tool names from untrusted documents.

Fix: Rebuild the tool registry each turn and reject shadowed names.
Open alternative: The reference MCP SDK keeps client-controlled tool names immutable.

A published, linkable statement about what the server retains from tool calls or conversations.

Fix: Publish a data-retention statement on the site.
Open alternative: A public docs page or trust report satisfies this without any vendor.

Verdicts and mutations produce hash-chained or signed evidence records.

Fix: Log verdicts with hash chaining or append-only storage.
Open alternative: Hash-chained logs with OpenSSL or an append-only Merkle log implement this pattern.