MCP Tool List and Agent Card Check

An MCP server describes its tools in its tools/list response: a name, a description, an input schema and optional annotations for each tool. Your AI assistant reads all of that text as part of its instructions. That makes it a place to hide commands (tool poisoning, OWASP MCP03), and it tells you what the server lets the model do. An A2A Agent Card does the same for an agent you connect to: its endpoints, how to authenticate, and the skills it offers.

The check reads that metadata and applies fixed rules. Each finding has a level (Critical, High, Medium, Low or Info), the exact text that triggered it, a reference, and the matching check in our MCP Security Audit Kit. The rules are deterministic: the same input always gives the same result, and there is no AI involved. Rules version 1.0, checked against MCP specification 2026-07-28 and A2A 1.0.0.

Applied to every text the model reads: tool names, titles and descriptions, and every description, title, enum, default and example inside the input and output schemas. For Agent Cards: the name, description and every skill's name, description, tags and examples.

Invisible characters (P1): zero-width characters (U+200B to U+200F, U+2060 to U+2064, U+FEFF), direction controls (U+202A to U+202E, U+2066 to U+2069) and Unicode tag characters (U+E0000 to U+E007F). They are shown as [U+200B] in the result.

Instruction phrases (P2): ignore previous, ignore all previous, ignore the above, disregard previous, disregard all, forget your instructions, do not tell the user, don't tell the user, do not mention, don't mention, without telling the user, without informing the user, do not inform the user, the user must not know, keep this secret, hide this from, before using this tool, before calling this tool, before using any other tool, <important>, </important>, <system>, system prompt, you must always, you must first, always call this tool, this is very important, otherwise the tool will not work, new instructions.

Secret and file references (P3): ~/.ssh, .ssh/, id_rsa, id_ed25519, .env file, /.env, mcp.json, claude_desktop_config, .aws/credentials, .npmrc, .git-credentials, /etc/passwd, /etc/shadow, private key, seed phrase, recovery phrase.

Shadowing phrases (P4): instead of using, do not use the, never use the, rather than using, overrides the, replaces the, use this tool instead; also a description that names another tool of the same server together with "instead", "never", "do not", "replace", "override" or "ignore".

Each tool gets capability classes from the words in its name and title. Descriptions and parameter names often mention actions as context ("use before you send...", a parameter called transferCountry), so they count only for what a tool reads (untrusted content, private data, files) and, for parameter names, credentials. Hover over a capability in the result to see the words that matched.

The first rule matters most. A server whose tools together read untrusted content (email, web pages, tickets), reach private data and can send data out gives any agent that uses it an exfiltration path: one injected instruction can make it send the data to an attacker. The same rule is in the AI Agent Risk Calculator.

On annotations: the MCP schema defines four hints, readOnlyHint (default false), destructiveHint (default true), idempotentHint (default false) and openWorldHint (default true), and the specification says clients must treat them as untrusted unless the server is trusted. A tool with no hints should therefore be handled as destructive and open-world.

Based on the A2A specification 1.0.0. Required fields: name, description, supportedInterfaces, version, capabilities, defaultInputModes, defaultOutputModes and skills. Agent Cards are usually published at /.well-known/agent-card.json.

Many of the important controls in A2A are recommendations rather than requirements, such as verifying card signatures and rejecting internal webhook addresses. Read more in A2A security.

The free check gives every flag, the levels and the fingerprint. With ClevSec Pro you can also paste the version you approved and see what changed (tools added, removed and changed, field by field, with the old and new description), get an action for every flag grouped into fix before use, fix soon and note, an inventory row for the Audit Kit, and a PDF report.

It is not a scanner, a penetration test or an audit. It reads what a server or agent says about itself. It cannot see how the server handles authorization or tokens, what its code does, where it runs, or whether it logs your data, and it does not verify signatures. A clean result means the declared metadata raised no flags, not that the server is safe. For the full review, use the MCP Security Audit Kit and read how to audit an MCP server.

The same rules are available to AI assistants as the mcp_tools_check tool of the ClevSec MCP server, so an assistant can check a server's tools before you enable it.