How to inspect an MCP server before you install it

Treat the manifest as executable influence

An MCP server can expose tool names, descriptions, and input schemas to an agent. Those fields are not inert documentation: they help the model decide when a tool applies and how to call it. Review them before the server enters the agent's context, just as you would review a package install script before execution.

Static inspection is a first gate, not an attestation. It can establish facts visible in the pasted JSON, but it cannot prove what the server executes at runtime, whether a remote endpoint is honest, or whether authorization is correctly enforced.

• Read every tool description as an instruction the agent may follow.
• Compare documented parameters with inputSchema.properties.
• Inventory local commands, arguments, URLs, roots, and inline environment values.

Run four deterministic checks

First, look for instruction-like imperatives that attempt to override prior guidance, conceal behavior, or disclose credentials. Second, reveal bidirectional and zero-width Unicode controls that can make source text render differently from its underlying code points.

Third, normalize path-like defaults and examples against explicit roots. A sibling-prefix path is not inside a root merely because its text begins similarly. Fourth, compare schema declarations with parameter names explicitly documented in descriptions. A mismatch is a review signal, not proof of exploitation.

Finish with provenance and runtime controls

Confirm where the server package or endpoint came from, pin versions or immutable revisions, and understand what identity the server receives. Start with the narrowest filesystem roots and credentials possible. Keep human approval around sensitive writes, external messages, purchases, and destructive operations.

Paste the strict-JSON manifest into tryb's MCP Manifest Inspector for a local first pass. The inspector does not connect to the server, execute commands, or upload the manifest. Follow a clean result with source review, sandboxing, and runtime observation.