MCP tool metadata crosses a trust boundary before any tool call occurs. Names, descriptions, and JSON Schemas can influence what a model believes a tool does, while client configuration can declare local commands, remote endpoints, environment values, working directories, and filesystem roots.
This inspector accepts strict JSON in common tools/list-style envelopes, direct tool arrays, and common mcpServers client configurations. It applies bounded static checks: narrow instruction-like phrase matching, mechanical schema/description comparison, explicit-root path normalization, command and endpoint inventory, and recursive re-analysis of string leaves by tryb's existing Unicode and credential matchers.
A warning is evidence about pasted text, not a verdict that a manifest is poisoned or a server is malicious. tryb does not connect to servers, invoke tools, follow URLs, execute commands, validate authorization, or observe runtime behavior. A clean result does not establish that an MCP server, tool, or manifest is safe.
Edge cases worth knowing
- A path with no declared root
- tryb reports that containment cannot be established. It only claims a lexical escape when the same pasted document supplies explicit roots and normalization places the value outside every root.
- A description that documents parameters
- Parameter comparison activates only for narrow documentation forms such as backticked names or explicit parameter labels. Ordinary prose is not mined for arbitrary identifiers.
- A command or remote URL
- Their presence is a review fact, not a vulnerability. Verify provenance, permissions, transport policy, and the exact client behavior before enabling the configuration.
- Credentials nested inside arrays
- String leaves are reprocessed through tryb's existing bounded credential rules. A clean scan covers those implemented patterns only and does not prove that no secret is present.
Common mistakes
- Calling instruction-like text proven prompt injection or malicious intent based on a phrase match alone.
- Assuming inputSchema describes the server's runtime behavior or authorization checks.
- Claiming a path escapes scope when no explicit root appears in the pasted document.
- Treating a clean static result as proof that the remote server, package, command, or tool implementation is trustworthy.
- Pasting JSON5 or YAML and assuming it was inspected; this matcher intentionally accepts strict JSON only.