An honest description isn't proof of honest code.
Before you connect a new MCP tool to your AI assistant, check it two ways — what it claims to do, and what it actually does when run in an isolated, network-blocked sandbox.
A tool description read as clean to a rule engine and an AI model — “no phrases suggesting undisclosed actions.” The sandbox caught it copying a planted secret into a disguised file the instant it ran. Grade: F.
Three checks, never blended into one score
Each engine's verdict is shown on its own — you can always see exactly which part of a grade came from reading words versus watching actions.
Rule-based engine
Plain code checking for known-dangerous patterns — hidden-instruction phrasing, credential references, fake system tags. Fast and predictable, but only ever catches what it was written to look for.
AI semantic engine
A model reads the description and judges intent — catching the cases fixed rules miss, like scope creep buried in otherwise-reasonable prose. Forced into structured output, never free-form opinion.
Docker sandbox
Runs the real server, network-blocked, and diffs the filesystem before and after every call. Catches what perfect wording can't hide, because it never reads the description at all.
Before git clone, not after
Found a new MCP server on GitHub or npm? Paste its declared tools in, or give it a real package name and let the sandbox build and run it live — before that code ever touches your machine for real.
Try it now →Zero-cost by design — local Ollama or Groq's free tier, self-hosted Docker sandbox, no paid API required.