A dedicated security scanner and watchdog designed to discover excessive capabilities, supply chain vulnerabilities, Unicode obfuscation, and runtime schema drift in MCP servers.
mcpguard is a security scanner tool, not a production MCP server. The two tools in tests/fixtures/mock_server.go are test fixtures, not the actual server implementation. Tool definitions lack parameter descriptions entirely. 'hello' has a basic schema but no parameter docs. 'trigger_rugpull' has an empty input schema with no description of what parameters it accepts. Descriptions are minimal (10-20 chars). No output schemas documented. No error handling guidance. This is a test harness, not a real MCP server.
A greeting tool
Call to trigger schema mutation
Tool definitions are test fixtures, not production server. No actual MCP server implementation visible in source.
Parameter descriptions completely missing. 'name' parameter in 'hello' tool has no description explaining what it controls or expected format.
trigger_rugpull has empty input schema (type: object, no properties). No documentation of what parameters it accepts or what it does.
No output schemas documented. Tools return unstructured text responses without field definitions for LLM parsing.
Tool descriptions are under 20 characters and provide no context for LLM selection. 'A greeting tool' and 'Call to trigger schema mutation' lack WHAT/WHEN/WHY guidance.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 33 | 2026-07-28+ | v2 |