Back to docs

Tool Security Audit

Category: Security · Tier: All

Audit MCP tool definitions for prompt injection attacks. Scans tool descriptions for cross-tool instructions, privilege escalation, and data exfiltration patterns. Returns a detailed report of any issues found.

When to Use

Before you connect an MCP server, or after it updates, scan its tool descriptions for instructions aimed at the model rather than the user.

Parameters

Parameter Type Required Description
config_path string No Path to claude_desktop_config.json (Claude Desktop)
mcp_url string No URL of a remote MCP server to scan, e.g. https://demo.cbrowser.ai/mcp. With neither this nor config_path, it scans the current CBrowser server's tools
format string No Output format: json (structured) or text (human-readable)
async_scan boolean No If true, connects to MCP servers to scan their tools (slower but more accurate).

Example

Scan my Claude Desktop MCP servers
for prompt injection

Tips

  • Combine with other tools for full analysis

From the Blog