Name: Guardbee
Brand: Guardbee
Availability: InStock

MCP guide · Tool Poisoning Scanner

MCP Tool Poisoning Scanner: description injection & confused deputy — @guardbee/mcp-tool-poisoning-scanner

@guardbee/mcp-tool-poisoning-scanner catches what Server Auditor cannot: malicious instructions hidden in a tool description (tool poisoning) and confused-deputy tools whose read-only name hides a dangerous handler.

What does it do?

Seven description-injection patterns plus four confused-deputy sink categories (process, code-exec, fs-write, credentials). Network fetches are deliberately excluded from confused-deputy.

Who is it for?

Teams reviewing third-party MCP server source before install
MCP marketplace / registry security reviews
Developers who want this check inside Claude or Cursor

What it is not

Handler sink scanning (use Server Auditor)
Live tools/list drift (use Rug Pull Detector)
Treating every network call as dangerous

Features

Feature	Description
Description injection	7 phrase / authority patterns
Confused deputy	read-only naming + dangerous sink
Next-tool-aware	Sinks are not misattributed across tools
SARIF 2.1.0	CI gates
guardbee.yml	fail-on, exclude

MCP tools

Tool	Description
`scan_text`	Scan a source snippet
`scan_file`	Scan a single file
`scan_directory`	Scan an MCP server source tree
`list_patterns`	List the pattern catalog

Install with npm

Global install (handy for Claude Desktop / Cursor):

bash

npm install -g @guardbee/mcp-tool-poisoning-scanner

or via npx (recommended with -y in config):

bash

npx -y @guardbee/mcp-tool-poisoning-scanner

npm: @guardbee/mcp-tool-poisoning-scanner

CLI

npx @guardbee/mcp-tool-poisoning-scanner scan ./mcp-server --fail-on=high --format=sarif > results.sarif

Claude Desktop configuration

Config file paths:

macOS~/Library/Application Support/Claude/claude_desktop_config.json
Windows%APPDATA%\Claude\claude_desktop_config.json
Linux~/.config/Claude/claude_desktop_config.json

Merge this block, then restart Claude Desktop:

claude_desktop_config.json

{
  "mcpServers": {
    "guardbee-tool-poisoning-scanner": {
      "command": "npx",
      "args": [
        "-y",
        "@guardbee/mcp-tool-poisoning-scanner"
      ]
    }
  }
}

Cursor and other MCP clients

In Cursor, add the same command / args / env under Settings → MCP. stdio MCP servers use the same contract as Claude Desktop.

Example prompts in Claude

“Is there tool poisoning in this MCP server source?”
“Do any get_ tools hide a shell or eval sink?”
“Which description-injection patterns do you support?”

See surface risk with Guardbee

MCP servers speed up security work in chat. Start a 14-day free trial for brand scans and BeeAI.

Start free MCP servers

Frequently asked questions

Vs Server Auditor?

Server Auditor looks at handler sinks; Tool Poisoning Scanner looks at description payloads and confused-deputy mismatches.

API key?

No — local source scanning.

False positives?

get_weather + HTTP is deliberately excluded from confused-deputy.

MCP Tool Poisoning Scanner: description injection & confused deputy