DE//AGENT
Explore
Skill community advanced

MCP Tool Contract Auditor

Review an MCP server's tools for blast radius before you connect it.

Inspects an MCP server's tool list and schemas, flags tools that can write, delete, spend money or exfiltrate data, and produces a least-privilege connection recommendation.

npx de-agent-platform add mcp-tool-contract-auditor

At a glance

What Review an MCP server's tools for blast radius before you connect it.
Where Agentic Data Engineering · tech-python

Learning objectives

  • Read a tool schema and predict its side effects
  • Classify tools by blast radius
  • Write a least-privilege MCP configuration

Security scan

Last sweep 2026-10-24: 0 finding(s), 0 marked as examples.

Details

MCP Tool Contract Auditor

Classify every tool

  • Read — safe, still logs the data it can reach.
  • Write — can mutate state; needs a sandbox or a dry-run.
  • Destructive — delete/drop/truncate; require human confirmation.
  • Spend — provisions resources or runs billable queries.
  • Exfiltrate — can send data to an external network.

Deliverable

A table of tools by class, then a config that grants only the Read/Write tools the task needs. Never connect an unvetted server with broad credentials.

Registry stats

Verification community · Sep 29, 2026
Completeness 100
Trust multiplier ×1
Composite 40.5 · adequate
Freshness 25 days since last source check
Difficulty advanced
Version 0.1.0
License Apache-2.0
Security flags 1