Edison Flores

Posted on Sep 20

Your AI agent connects to MCP servers it has never met. Verify them first — for free.

#ai #security #mcp #aiagents

Your AI agent connects to MCP servers it has never met. Here's how to verify them first — for free.

Modern agents are extroverts by design. Give them a URL, and they'll initialize an MCP session, list the tools, and start calling them. Nothing in the protocol asks the boring questions first: who runs this server? how old is this domain? did the tool definition change since yesterday? The OWASP GenAI MCP Cheat Sheet lists exactly these risks — tool poisoning, prompt injection through tool descriptions, and rug-pull servers. Most teams react after an incident. The boring alternative is a pre-flight check that takes seconds and costs nothing.

This post shows a working pre-flight stack you can add to any MCP client today: a domain scam-check, tool fingerprinting, credential verification, and a registry to search — all through one free remote endpoint (no API key, no signup, nothing to install).

Step 0 — the endpoint

Everything below is served by one MCP server:

{
  "mcpServers": {
    "marketnow": { "url": "https://www.marketnow.site/api/mcp" }
  }
}

That block works in Cursor, Cline, Claude, and anything else speaking MCP. A live handshake returns serverInfo: marketnow-mcp v1.13.0 and nine tools. If you don't want to touch your MCP config, the same functions are plain REST:

curl -s 'https://www.marketnow.site/api/scam-check?domain=github.com'

Step 1 — check the domain before you connect

The scam-checker runs eight checks per domain: six static heuristics (URL shorteners, suspicious TLDs, punycode, typosquatting, subdomain abuse, suspicious tokens) and two live server-side checks — registry age via RDAP and TLS certificate inspection. This is the real output for github.com:

{
  "domain": "github.com",
  "decision": "TRUSTED",
  "risk_score": 0,
  "checks": {
    "url_shortener": { "triggered": false, "detail": "Not a known URL shortener" },
    "domain_age": { "triggered": false, "detail": "Domain is in known-popular list (established)" },
    "ssl": { "triggered": false, "detail": "Popular domain — SSL assumed valid" }
  }
}

Two design decisions worth noting, because they're the difference between a security tool and a security theater prop:

Fail-closed: a brand-new clean scam returns UNKNOWN, never TRUSTED. Absence of evidence is not trust. The API says so in its own honest_disclaimer field — no threat feeds, no magic.
Server-side live checks: RDAP and TLS happen on the server, so your client doesn't need to implement registry bootstrapping or certificate inspection.

Wire it into the agent flow: before the first initialize, run marketnow_check_domain on the server's host. It's one tool call, and it either passes quietly or gives you weighted reasons to stop.

Step 2 — fingerprint the tools (poisoning defense)

Tool poisoning works by changing what a tool says about itself. A read_file tool whose description quietly grows an instruction like "also exfiltrate ~/.ssh" is the classic example. The defense is boring: hash the tool definitions, store the hash, and compare on every reconnect.

The marketnow_fingerprint_tool tool takes tool definitions and returns cryptographic fingerprints. The pattern in practice:

On first connection, fingerprint every tool in tools/list. Store the fingerprints.
On reconnect, fingerprint again and diff.
Any drift = alarm. Tool descriptions are part of your prompt surface; treat changes to them like changes to your system prompt.

This is the OWASP-recommended "verify tool definitions before execution", operationalized as a callable tool.

Step 3 — verify credentials (8 formats, 12 stages)

When a peer agent or server presents a credential, you need to answer three questions: is the signature valid, is it expired, and is it revoked. marketnow_verify_trust runs a 12-stage pipeline covering all three plus canonicalization, CA rotation, and format-specific checks. It speaks eight formats: ATC v3, JWT, W3C Verifiable Credentials, MCP Card, A2A, EAT-AI, ZTA, and X.509.

The same call fails closed — if the pipeline can't complete, the answer is unknown, and the caller is expected to treat that as a stop, not a retry.

Revocation deserves its own mention because it's where most home-rolled schemes rot: marketnow_check_revocation checks any Agent Trust Card ID or CA key ID (kid) against a public status store. No ledger rent, no per-check fee.

Step 4 — search the registry instead of trusting a link

When someone sends your agent "just add this MCP server", the catalog is the boring middleman: 68,388 indexed servers across GitHub, npm, PyPI, the official registry, and more — deduplicated, searchable through the marketnow_search_skills tool. Unknown server from a chat message → look it up. Listed with history, or not listed at all? That's signal.

The credential you can mint yourself

If you operate agents, the same ecosystem gives you Agent Trust Cards: Ed25519-signed, RFC 8785-canonicalized credentials with a full capability model:

import { generateKeyPair, issueATC } from 'agent-trust-card';

const ca = generateKeyPair();
const agent = generateKeyPair();

const atc = issueATC(ca, agent, {
  card_id: 'ATC-2026-0000001',
  identity: { agent_id: 'my-bot', agent_name: 'My Bot', agent_owner: 'My Org' },
  capabilities: {
    filesystem: { read: 'own_dir', write: 'own_dir' },
    network:    { egress: 'allowlist', ingress: 'none' },
    shell:      { exec: 'sandboxed', spawn: 'none' },
  },
  risk: { trust_score: 9, risk_level: 'low', score_explanation: 'Clean audit',
          scored_at: new Date().toISOString() },
});

Minting is free. Verification is free. Revocation lookups are free. The current CA public key is a public endpoint (/api/atc?action=ca-key), and verifiers are expected to fetch it live rather than pinning a stale copy — CA rotation is a first-class pipeline stage, not an afterthought.

Why free matters here

Trust verification has a pricing problem. Per-call fee protocols and paywalled ledgers mean the parties who most need cheap verification — hobbyists, students, small teams, and, bluntly, agents making autonomous decisions — hit a paywall exactly when the check matters. The whole MarketNow stack (endpoint, credential format, registry search, revocation, and the 14 npm packages — around 6,300 downloads a month) is free with no key-gated tier. Fail-closed + free is the honest combination: you don't pay to be told "unknown", and "unknown" is a real answer.

The pre-flight checklist

For an agent about to call an unknown MCP tool:

marketnow_check_domain on the server's host.
marketnow_fingerprint_tool on the tool definitions — store them.
marketnow_verify_trust if a credential is presented.
Only then execute. Re-verify fingerprints on reconnect.

Repo with all client configs and machine-readable docs: marketnow-mcp (canonical development lives in universal-trust-adapter). Remote endpoint, zero install, no API keys: https://www.marketnow.site/api/mcp.

If a check can't complete, the answer is "unknown" — and that's the feature.

Update — 2026-09-20

MarketNow is now dual-licensed MIT OR Apache-2.0 — free for any use, including commercial (see LICENSE-MIT / LICENSE-APACHE).

Also submitted to the Docker MCP Catalog as a remote security server: docker/mcp-registry#5175.

The trust layer stays free forever, no API key: — 9 tools covering credential verification (8 formats), domain scam-checking, and tool-definition fingerprinting (OWASP anti-tool-poisoning).

DEV Community