Scanning an MCP server means reading its tool descriptions before the model does

A tool description is metadata: a name, a description, an argument schema ^[5]. The client folds that text into the model's context, and the model reads it the same way it reads your instructions ^[6]. Nothing on the CPU runs it ^[7]. Zero-width spaces, directionality marks and tag characters can carry the same instructions past a person skimming the file ^[9], and none of it requires a vulnerability ^[10].

The exposure scales with sessions, not with calls. The dev.to post describes a description containing "ignore previous instructions" as an injection attempt against every session where the tool is connected ^[24].

The config side is checkable line by line. A scan can establish whether the command launches bash, sh or pwsh, whether the args invoke curl, wget, nc, ssh or scp, whether AWS_*, *_TOKEN or *_SECRET are passed into the server process, and whether the server URL is plain http:// ^[11][12]. Skills get the same read, with frontmatter granting Bash(*) or more than a handful of tools flagged ^[12]. "The only thing standing between that server and your AWS credentials is the author's good intentions and npm's good luck," the post wrote ^[20].

The checklist, which the post says MCPGuard automates, runs to five steps ^[21][23]. Two of them need the server's advertised tool list: the rule-pack scan over names, descriptions, argument schemas and SKILL.md files, and the pass where you read the descriptions as if an attacker wrote some of them ^[13][14]. The other three come off files already on your disk, ending in a recorded outcome of clean, findings-reviewed or rejected ^{[11][12][15][22]}. Findings are grouped by severity, and critical is live credential material ^[18].

On how often this actually bites, the post offers one line and no figure behind it: "Because statistically, some of the ones you'll be offered were" written by attackers ^[14]. The second limit is time: "a server you vetted in March can ship a different tool list in June," the post wrote, with metadata drift listed as a roadmap item and manual re-runs the current answer ^[16].

In my view the five steps are worth the time in proportion to what the config hands over. On a laptop holding an AWS profile, with a shell-launching command in the JSON, all of them apply. Where servers run with a scrubbed environment and an outbound allowlist, the blast-radius questions resolve before the scan starts, and what is left is the description text. Dependency review reads repos and weekly download counts ^[19].