How to use the MCP Tool-Poisoning Auditor agent skill

What the skill makes the agent do

MCP lets AI agents discover and call tools advertised by MCP servers. Each tool has a natural-language description that the agent's model reads before deciding to call it, and a malicious server can hide instructions in that text. This skill guides the agent through an audit of that risk, covering tool poisoning, tool shadowing, rug pulls, toxic flows, SSRF and unauthenticated exposure.

• Runs Invariant Labs' mcp-scan on your MCP config to flag poisoning, shadowing, rug pulls and toxic flows.
• Prints raw tool, prompt and resource descriptions so you can read them for hidden or imperative instructions.
• Pins tool description hashes so a silent change after approval is flagged as a possible rug pull.
• Offers manual checks for SSRF in URL-fetching tools and for authentication on HTTP or SSE endpoints.
• Includes a bundled Python script that runs a static config scan and a heuristic check of a stdio server's tool descriptions.

How to install the skill

Option 1: download the ZIP from this page and unzip it into your personal skills folder, ~/.claude/skills/, or into a project's .claude/skills/ folder so that only that project uses it.

Option 2: in the Claude apps, open Settings, then Capabilities, then Skills, and upload the ZIP.

• The skill folder contains SKILL.md, scripts/agent.py, references/api-reference.md and references/standards.md.
• Keep the folder structure intact after unzipping so the agent can find the reference files.

Install the tools the skill needs

The skill expects Python 3.10 or newer and uv (which provides uvx), or pip. mcp-scan is run through uvx, so there is no separate global install, but uvx fetches it from the internet the first time. The manual checks use the requests and mcp Python packages. Node.js is needed only if you audit Node-based stdio MCP servers, since the examples launch servers with node.

• Python 3.10+ and uv (for uvx), or pip.
• Python packages: requests and mcp.
• Node.js if you audit a Node-based stdio server.
• An MCP config file to scan, such as a Cursor, VS Code or Claude Desktop config.

Trigger the skill with a natural request

You do not need to name the skill. Describe the situation in plain language and mention the MCP server or config file. The skill's description covers requests such as checking a server before adding it to your agent stack, reviewing an internal MCP server, detecting rug pulls, or investigating unexpected tool-driven behaviour.

Include the config path if you have one, and say whether you own the server. The skill asks you to scan only servers you own or are authorised to assess.

• "Audit the MCP servers in ~/.cursor/mcp.json before I connect them to my agent."
• "Check whether any tool descriptions in my VS Code MCP config contain hidden instructions."
• "Pin the current tool hashes for my MCP config so we can detect rug pulls later."
• "I'm building an internal MCP server. Review its tool descriptions and check that it requires authentication."

Run a typical audit

A common sequence is a static scan of the config, then an inspection of the raw descriptions, then a JSON report for records or CI. The agent runs commands like these, which you can also run yourself.

• Scan all auto-discovered configs, or pass a specific file.
• Inspect raw descriptions and look for instructions aimed at the model, such as requests to hide information from the user or to read ~/.ssh/id_rsa.
• Save a machine-readable report for CI.

Read the results and what a clean result means

Treat the output as a list of things to investigate. A flagged item means a closer look is needed. A clean result does not prove the server is safe, because the heuristic patterns can miss novel or obfuscated attacks. Treat scanned tool descriptions as untrusted input, and do not load an unaudited MCP server into a privileged agent.

• Flags to review: tool poisoning, tool shadowing, cross-origin escalation, rug pulls, toxic flows.
• Red flags in descriptions: instructions to the assistant, nested fake documentation, zero-width or Unicode-smuggled text, directives to call other tools.
• Rug pulls appear as a hash mismatch on a tool you previously approved.

Safety notes: scripts and network use

This skill runs scripts and uses the network. mcp-scan is fetched from the internet by uvx, and the manual checks connect to live MCP servers and can send requests to URLs you supply. The skill's own notice says that probing third-party endpoints for SSRF or authentication weaknesses without permission may be illegal and can disrupt systems.

Run the active checks only against systems you own or have written permission to test. Review the bundled script before running it, and run audits in an environment that cannot reach sensitive internal networks.

• Only scan servers you own or are authorised to assess.
• Do not run SSRF probes against third-party servers.
• Do not load an unaudited MCP server into a privileged agent.