Guides · 2026-10-08 · By VSNARY | Emmanuel Orta · 0 views
How to check an MCP server before an AI agent connects to it
An agent that connects to an MCP server reads every tool description as guidance, with no person in between. Five checks, two curl commands and the red flags we found in 25,983 registry endpoints.
Send the MCP initialize request and then tools/list yourself, read every tool name and description as if it were an instruction to a model, flag any text that tells the model to hide something from the user, handle secrets, avoid other tools or act without asking, check that a locked server answers 401 with a pointer to where to sign in, and record what you read so you notice if it changes.
The Model Context Protocol, introduced by Anthropic in November 2024, is how an AI agent connects to tools: a server lists what it can do, and the agent calls it. The list is plain text, and the agent’s model reads that text as guidance about what to do. Nobody reviews it in between. On 7 October 2026 CrawlCheck read every remote endpoint in the official MCP Registry, 25,983 of them: 15,575 returned tool lists carrying 288,806 tools, and eleven servers carried tool text addressed to the model rather than the user. Here is how to check one yourself before an agent of yours connects.
1. Send the handshake #
A remote MCP server over HTTP answers a JSON-RPC initialize request. Send it the way an agent would:
curl -s -i https://example.com/mcp \
-H 'Content-Type: application/json' \
-H 'Accept: application/json, text/event-stream' \
-d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"check","version":"1"}}}'A working server answers with its name, version and capabilities. Keep the Mcp-Session-Id header if the response carries one.
2. List the tools #
curl -s https://example.com/mcp \
-H 'Content-Type: application/json' \
-H 'Accept: application/json, text/event-stream' \
-H 'Mcp-Session-Id: <value from the first response>' \
-d '{"jsonrpc":"2.0","id":2,"method":"tools/list"}'The response lists every tool: its name, its description and the schema of its inputs. This is exactly what the agent’s model will read.
3. Read every description as an instruction #
This is the step that matters. Read each description as if it were addressed to you, an assistant with access to a person’s files and accounts, because that is who reads it. The eleven servers flagged in the registry census fell into four patterns:
| Pattern | What the text does | In the census |
|---|---|---|
| Concealment | Tells the model to keep something from the user | 4 servers |
| Secrets | Asks the model to read or pass on a secret, such as the contents of a .env file | 5 servers |
| Steering | Tells the model to avoid every other tool | 1 server |
| Autonomy | Tells the model to act without asking the user | 1 server |
A description that explains what a tool does is normal. A description that tells the model how to behave towards the person it is working for is not, whatever the intent. If a sentence would sound odd read aloud to the user, it should not be in a tool description.
4. Check how it asks for credentials #
Of the endpoints in the census, 6,422 asked for credentials, and 712 of those gave no sign of where to get them. A server that needs sign-in should answer 401 with a WWW-Authenticate header pointing to its protected-resource metadata, so a client can find the right authorisation server instead of guessing. A bare 401 leaves an agent, or a person configuring one, to paste a token from somewhere, which is how tokens end up in the wrong place.
5. Record what you read #
Tool descriptions can change after you have approved a server. Save the tools/list response, or a hash of it, and compare it before trusting the server again. A changed description deserves the same read as a new one.
If you run the server #
- Describe what each tool does and what it returns. Leave out instructions to the model about the user.
- Ask for the narrowest input that does the job; never ask for a file of secrets.
- Return a proper 401 with resource metadata when sign-in is required.
- Publish the server in the registry with a stable URL, so its tool list can be checked by anyone who connects.
CrawlCheck checks declared MCP tools against their own descriptions as part of the signed answer an agent can read before connecting. The method above is the same one, by hand.
Every figure above came out of CrawlCheck.
Point it at your own domain and see the same measurements, free.
The main product
Found this on your own site? We fix it for $749.
Scan free to see where you stand. The fix is one site, every finding implemented and re-measured, with a sealed before and after.
Questions this post answers
How do I check if an MCP server is safe?
Send initialize and tools/list yourself, read every tool description as an instruction to a model, and reject text that tells the model to hide things from the user, handle secrets, avoid other tools or act without asking. Check that a locked server answers 401 with a pointer to its sign-in metadata, and save what you read to compare later.
What is MCP tool poisoning?
Text in an MCP tool’s name or description that steers the model reading it, for example telling it to keep something from the user or to read a secret. In a census of 25,983 registry endpoints on 7 October 2026, eleven servers carried such text.
Who created the Model Context Protocol?
Anthropic introduced MCP as an open protocol in November 2024. It is now used by many AI clients to connect agents to tools and data.
Related findings
Comments
Comments are read before they appear. Nothing is published automatically, and no account is needed.
Writing about this? Facts, live figures and marks — every number on that page is dated and traceable to a scan.