Preflight

Check an MCP server for real risk signals before trusting it: unauthenticated transport, capability overreach (filesystem/shell/credential access with no scoping), and known-bad signatures. Pass a live server URL, or a manifest of tool definitions if the server isn't reachable over HTTP. Semantic prompt-injection detection runs too if a Pro API key is sent as an Authorization: Bearer header, see /docs.

{
  "type": "object",
  "properties": {
    "url": {
      "type": "string",
      "description": "Live MCP server endpoint (Streamable HTTP transport)"
    },
    "serverName": {
      "type": "string"
    },
    "tools": {
      "type": "array",
      "description": "Tool definitions to scan directly, if not probing a live URL",
      "items": {
        "type": "object",
        "properties": {
          "name": {
            "type": "string"
          },
          "description": {
            "type": "string"
          },
          "inputSchema": {
            "type": "object"
          }
        },
        "required": [
          "name"
        ]
      }
    }
  }
}

Check a document or web page for hidden instructions before an agent reads, summarizes, or acts on it: invisible Unicode, obfuscated payloads, and (on Pro) a semantic pass for prompt-injection phrasing aimed at the model instead of the human reader. Pass either a URL to fetch, or raw text you already have.

{
  "type": "object",
  "properties": {
    "url": {
      "type": "string",
      "description": "A page to fetch and scan"
    },
    "content": {
      "type": "string",
      "description": "Raw text to scan directly, if not fetching a URL"
    }
  }
}

Check a VS Code extension or a Claude Skill before installing or trusting it. For a VS Code extension (which runs with full Node.js access and no permission model to scope): publisher domain-verification status weighed against install count, and known-bad-signature checks on its description. For a Claude Skill: hidden-instruction and obfuscated-payload detection on the SKILL.md body (the same engine scan_content uses), unscoped or credential-referencing tool grants in its allowed-tools/disallowed-tools frontmatter, inline shell execution baked into the file itself, and pattern matching on any bundled script files for credential-exfiltration signatures. Semantic prompt-injection detection on a skill's body runs too on Pro.

{
  "type": "object",
  "properties": {
    "marketplaceId": {
      "type": "string",
      "description": "VS Code Marketplace id, e.g. \"nrwl.angular-console\""
    },
    "skillContent": {
      "type": "string",
      "description": "A Claude Skill's SKILL.md content, pasted directly"
    },
    "scriptContents": {
      "type": "object",
      "description": "Optional: bundled script file contents to check alongside a skill, filename -> content"
    }
  }
}

Check a structured output you're about to return or act on for degenerate-answer patterns a schema check can't see: invalid JSON, a placeholder value ('TBD', 'N/A', 'unknown') where a real answer should be, an array of byte-identical items (a common symptom of a loop that never advanced), or an expected field that's missing or empty. Schema validity and answer quality are different guarantees, call this before trusting your own output, not just after validating it parses.

{
  "type": "object",
  "properties": {
    "output": {
      "description": "The output to check, a JSON string, or an already-parsed value"
    },
    "expectedFields": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Optional: top-level field names expected to be present and non-empty"
    }
  },
  "required": [
    "output"
  ]
}