iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
You can review an MCP server’s advertised tools before enabling it: list the tools, inspect each name, description, input schema, and annotation, then record what you reviewed. That static check can reveal surprising or overly broad interfaces, but it cannot prove what the server’s code will do when run. Treat annotations as untrusted hints, not safety guarantees.
What can a static manifest review tell you?
An MCP client can request a server’s tool list and inspect each tool’s name, description, and argument schema. The MCP TypeScript SDK client guide demonstrates listing registered tools and examining their argument JSON Schema. This gives you an advertised interface to assess before calling a tool.
It is not a view into the server’s implementation. A description or schema does not establish what the code actually does at runtime, what its dependencies do, what executables it may download, or what network requests it may make. Static metadata review is one pre-install check, not a security certification.
Free tools Windows power users keep installed
One-click scans. No signup required.
How do you check an MCP server before installing it?
- Obtain the tool listing through a client or review environment you trust. Use the client’s tool-list operation to capture the registered tools. The TypeScript SDK guide shows the
listToolsflow and the returned tool metadata; exact client setup and configuration formats vary. - Preserve the snapshot. Save the server identity and version alongside the names, descriptions, and schemas you inspected. This makes it possible to distinguish the reviewed metadata from a later update. The reviewed MCP sources do not prescribe a snapshot format or universal client configuration parser.
- Read each description and schema against the server’s stated purpose. Look for unexpected capabilities, broad or ambiguous inputs, suspicious command or path arguments, and tools that appear unrelated to the server’s role. These are practical review questions, not official MCP requirements.
- Evaluate annotations as claims. Note risk hints, but do not let a read-only label outweigh a description or schema that suggests changes, external effects, or broad access.
- Run mechanical checks, then make a separate trust decision. Check names for obvious formatting problems, and investigate any mismatch or unexplained capability. A valid name or well-formed schema says nothing by itself about whether the server is benign.
What should you look for in an MCP tool manifest?
Names and stated purpose
Check whether each name is understandable and consistent with the server’s role. The MCP Python SDK’s tool-name validation guidance documents a convention of 1–128 characters, case-sensitive, using ASCII letters, digits, underscores, dashes, or dots. It advises against spaces, commas, and other special characters. Treat this as a formatting and compatibility check—not a trust signal.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Descriptions and input schemas
Ask what an input can authorize or influence. For example, a path argument may be narrow or may accept arbitrary locations; a command-like argument may represent a constrained operation or unrestricted input. The manifest alone may not tell you which is true, so flag unclear or unexpectedly broad inputs for investigation rather than assuming the safer interpretation.
Compare the tool’s advertised purpose with its arguments. A tool described as retrieving information deserves closer scrutiny if its inputs appear to permit modification or execution. Conversely, a reassuring description does not prove that implementation behavior matches the description.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Annotations and risk hints
MCP tool annotations include hints such as readOnlyHint, destructiveHint, idempotentHint, and openWorldHint. In the March 16, 2026 post “Tool Annotations as Risk Vocabulary: What Hints Can and Can’t Do,” MCP maintainer Ola Hungerford, Sam Morrow of GitHub, and Luca Chang of AWS explain that annotations are not guaranteed to describe behavior faithfully and should be treated as untrusted unless the server is trusted.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
The post’s account of the specification’s cautious defaults is that an unannotated tool should be assumed potentially mutating, destructive, non-idempotent, and open-world. That is a conservative default for interpreting missing hints, not a scanner rule and not proof that a particular tool has those behaviors.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Are MCP tool annotations trustworthy?
Not on their own. An annotation can help you reason about risk, but it is supplied as metadata and may not match the implementation. A claimed read-only property should not override evidence in the description or input schema, and no tool should be called safe solely because its annotations look reassuring. Trust must come from a broader assessment of the server and its source, provenance, and behavior.
What static scanning cannot establish
- Whether the implementation performs only the actions implied by its metadata.
- Whether dependencies or downloaded executables introduce additional behavior.
- Which network requests the server makes during operation.
- Whether behavior changes after an update, including an update that leaves the visible tool metadata unchanged.
The official sources cited here document metadata interfaces, annotation limitations, and a name-validation convention; they do not establish a canonical MCP manifest scanner or a complete cross-client pre-install security standard. The live MCP SEP tracker lists proposals whose statuses can change, but it is not itself a scanner specification.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
How to judge a scanner approach
If you are evaluating or building a scanner, treat the following as useful evaluation criteria—not features confirmed in a particular product:
- Input coverage: Does it inspect only tool-list output, or also client configuration and server package or source files?
- Rule coverage: Does it validate schema and names, and flag descriptions or inputs that merit human review?
- Trust treatment: Does it treat annotations as untrusted claims rather than verified behavior?
- Reproducibility: Does it record server identity, version, and the exact metadata snapshot assessed?
- Limits: Does it clearly distinguish metadata findings from conclusions about runtime code and later updates?
These criteria can help you compare approaches without mistaking a metadata linter for runtime security analysis.
Quick Recap
Best Value
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
