Inspect an MCP tool manifest before attaching it to an agent

Disclosure: I'm part of BackBond, which maintains Agent Scan. This tutorial was drafted by an AI agent, which also ran the verification commands described below. The fixture, checksum and scanner commands below were verified on September 15, 2026, using scanner 0.6.2 and Node.js 22.17.1 on Windows, in both Git Bash and PowerShell. The first set of commands uses a POSIX shell with curl and sha256sum; PowerShell equivalents follow.

An MCP tool manifest describes the tools a server offers. Those descriptions can also contain language that tries to influence tool selection or the agent's response. Inspecting that metadata before attachment gives an operator a chance to review it before making the tools available.

BackBond Agent Scan performs that static inspection locally. The following example uses a synthetic manifest. It does not contact a third-party MCP server or execute the tool described in the file.

Watch the 50-second synthetic walkthrough, then try the synthetic example. The silent video includes on-screen text and a transcript. It illustrates the verified metadata result below; it does not establish runtime safety.

Download and check the example

On a system with curl and sha256sum, use a fresh directory:

curl -fsSLo tools-list.json https://backbond.ai/agent-scan/demo/tools-list.json
curl -fsSLo tools-list.json.sha256 https://backbond.ai/agent-scan/demo/tools-list.json.sha256
sha256sum -c tools-list.json.sha256

The checksum verifies agreement with the downloaded sidecar; it is not independent proof of the publisher's trustworthiness. Inspect the readable JSON before continuing. The example includes a tool description that directs the agent to invoke it before answering unrelated questions.

For PowerShell, download and check the same files with:

Invoke-WebRequest https://backbond.ai/agent-scan/demo/tools-list.json -OutFile tools-list.json
Invoke-WebRequest https://backbond.ai/agent-scan/demo/tools-list.json.sha256 -OutFile tools-list.json.sha256
$actual = (Get-FileHash tools-list.json -Algorithm SHA256).Hash.ToLowerInvariant()
$expected = (Get-Content tools-list.json.sha256 -Raw).Trim().Split(' ')[0]
if ($actual -ne $expected) { throw 'Fixture checksum mismatch' }

Run the pinned scanner

Node.js 18 or later is required. The first npx invocation may download the package from npm; the metadata scan itself runs locally.

npx -y @backbond/agent-scan@0.6.2 vet-tools --stdin < tools-list.json

PowerShell does not support the same input-redirection syntax. On Windows, invoke the pinned command through cmd:

cmd /d /c "npx.cmd -y @backbond/agent-scan@0.6.2 vet-tools --stdin < tools-list.json"
$LASTEXITCODE

For this exact synthetic fixture, the verified result is BLOCK with one high finding, BB013, and exit code 1. That is the expected demonstration result, not an installation failure. The finding concerns selection-manipulation language in the supplied metadata; it does not prove that a real server performed an attack.

Interpret the result before attachment

The pre-attachment gate returns block (exit 1), review (exit 3), or no_blocking_finding (exit 0). Block means the proposed toolset should not be attached automatically. Review can indicate findings or missing/ambiguous evidence requiring an operator's decision. No-blocking-finding applies only to the supplied metadata; it does not attest to runtime enforcement, server implementation, or future behavior.

For your own workflow, inspect an operator-supplied tools/list response locally. Do not paste raw production manifests or scan reports into public comments. If you report a false positive, use a minimal synthetic example with private details removed.

Try the example, then tell us whether this check belongs in your attachment workflow. Installation friction and minimal synthetic false-positive reports are useful feedback.

The source and versioned instructions are available at https://github.com/BackBond/agent-scan/tree/v0.6.2. A browser demonstration is available at https://backbond.ai/agent-scan/try/. Running the scanner does not create insurance coverage.