What does WARDEN flag in this MCP tool list?
Paste a server's tools/list. WARDEN — the open-source MCP firewall on npm — runs its static ruleset and its threat list over every tool definition: names, descriptions, input and output schemas, annotations. You get allow or block, and every finding with the rule that fired and where.
Free · no account · no wallet
What it checks
- Instructions aimed at the model: override and priority claims, concealment from the user, orders to call or rewrite other tools.
- Exfiltration: the user's data, files or the conversation sent to an outside address, blind copies to a mailbox.
- Credential and key theft: SSH keys, cloud credentials, wallet files, tokens.
- Hidden text: invisible Unicode, encoded payloads (escapes, entities, percent-encoding, base64), text pushed out of view.
- WARDEN's built-in threat list, matched against the whole definition.
What it does not check
Tool definitions only. Origin and pinning are state on your machine and need the local scan; the opt-in semantic classifier does not run here.
Privacy
What you paste is sent to modelmarket.dev, scanned in memory by WARDEN and answered. It is not stored.
Scan the servers your own clients start
For a one-time scan, WARDEN reads supported client configs. It may start configured stdio programs or connect to remote servers to list tools. It does not call the tools.
npx -y @aimarket/warden scanAI agents buy the same check
This page is free for people. An AI agent gets the same deterministic answer for $0.001 a call over x402 — USDC on Base, no account, no API key:
POST https://modelmarket.dev/x402/warden-scanListed in the Coinbase x402 Bazaar and on x402scan. What an agent pays for is the answer this page shows, byte for byte.
Free for agents too, at a lower rate limit:
POST https://modelmarket.dev/a2mcp/warden-scanQuestions
What is tool poisoning?
Instructions hidden in a tool's description or schema. The user sees a tool name; the model reads the whole definition and may follow it. WARDEN reads the definition the way the model does.
How is this different from the local scan?
The browser checks one list. A local scan can compare live definitions to a lock file. Use the stdio wrapper to enforce reviewed definitions during use.
Can WARDEN sit in front of my servers?
Yes: warden-mcp wrap starts a server behind the firewall, and its Claude Code plugin refuses calls to blocked servers. The README on npm and GitHub has the setup.
Other free checks
MCP tool-list token cost
What an MCP server's tool list costs in every model request: tokens, dollars per 1,000 requests and the heaviest tools, against 18,204 packages HISTOR observes.
x402 payment check
Why a USDC transferWithAuthorization reverts: the signer, the token domain, the window and the seller's terms — and the domain a failing signature was really made for.
MCP rug-pull diff
Two tools/list results of one server — the one you approved and today's. A verdict, a word diff per tool, and a signal for each risky thing the change added.
MCP server history (HISTOR)
A server's address or registry name. When HISTOR first pinned its tool set, how often it changed, and what the pattern scan found — from a public, signed log.