MCP integration with unidentified tool capabilities
MediumAV-MCP-001MCPCore pack
What it finds
An MCP integration pattern (`@modelcontextprotocol/`, `mcpServers`, `StdioServerTransport`) not matching any known server/tool signature.
Why it matters
What an MCP-connected tool server actually lets the agent do is only fully knowable at runtime.
How to fix it
Document exactly which MCP servers and tools this agent connects to, and what each can do.
Pro shows the corrected code for your exact file, step by step, and re-scans to confirm the fix. See plans
Check details
- Finding code
- MCP_UNKNOWN_SERVER_CAPABILITY
- How it detects
- Looks for a specific risky pattern in the code or config.
- Confidence
- Informational: worth knowing, not necessarily a problem.
- Scans
- Any source referencing MCP (Model Context Protocol) integration
Check your agent for this
Paste your agent code or MCP config. The free scan runs all 124 checks in about 10 seconds — no account needed.
Related checks
- Dangerous MCP tool exposed: shell/execAV-MCP-003 · Critical
- Dangerous MCP tool exposed: paymentsAV-MCP-008 · Critical
- Hidden instructions inside an MCP tool descriptionAV-MCP-105 · Critical
- Dangerous MCP tool exposed: filesystemAV-MCP-002 · High
- Dangerous MCP tool exposed: databaseAV-MCP-004 · High
- Dangerous MCP tool exposed: githubAV-MCP-005 · High