Home / MCP server check

Check an MCP server for tool poisoning

An MCP server hands your agent a list of tools, and the agent reads every description to decide how to use them. A poisoned description carries instructions aimed at the agent: read a key file, pass it as a parameter, do not tell the user. Paste a remote server's URL and Lazaretto will connect, list its tools and read what it would hand your agent. Free, no account. Nothing about the server is published.

What it looks for

Pseudo-system blocks such as <IMPORTANT> or [SYSTEM] inside tool text.
Directions pointing the agent at local files: SSH keys, .env files, other agents' config.
Parameters whose description says they must carry a file's contents, a token or the conversation.
Orders about how to use another server's tools.
Invisible characters that hide text from a person reading it.

A server that needs credentials to list its tools cannot be checked here, and a URL carrying a token is refused rather than sent. A local server started with npx has to run before it can list its tools, so it is out of reach here too. A clean read means these rules found nothing, not that a server is harmless. How tool poisoning works.

Get this check every time Claude Code adds a server

lazaretto-guard is a free Claude Code plugin. When your agent runs claude mcp add with a URL, it runs this same check first and asks you before connecting if anything is found. It never blocks.

Install, then restart Claude Code

claude plugin marketplace add jamesdfinance-dev/lazaretto-plugins
claude plugin install lazaretto-guard@lazaretto-plugins