Static analysis and drift detection for the surface an MCP server exposes to an agent.
Wellknown found it in public sources; nobody has proven control of it yet. Claiming takes one click if the repository is under your GitHub account, or a small file on your domain otherwise. Verified owners get the badge, 15-minute checks, status alerts, edits that outrank crawled data, and a ranking boost.
Agents can do it too: POST https://wellknown.network/api/v1/claims with {"agent":"mcp-placard","method":"well_known_file"} — machine-readable steps at claim.json, guide at /docs/claim.
Everything here was measured by our prober or read from a registry. Nothing is self-reported.
Attributed to the source that supplied each field. Treated as claims, not facts.
# Placard [](https://pypi.org/project/mcp-placard/) [](https://pypi.org/project/mcp-placard/) [](https://github.com/Lanier-Developments/mcp-placard/actions/workflows/ci.yml) [](LICENSE) [](AGENTS.md#security-posture) Static analysis and drift detection for the surface an MCP server exposes to an agent. ```bash pip install mcp-placard placard scan "npx -y @modelcontextprotocol/server-filesystem ." --out baseline.json # ... a week later placard scan "npx -y @modelcontextprotocol/server-filesystem ." --out current.json placard diff baseline.json current.json # exit 1 escalation, 2 prompt change, 3 removal ``` Teams wire agents to Model Context Protocol servers with no record of what capability they just granted, and no mechanism to notice when that capability changes. A server can add a destructive tool, or silently rewrite a tool description — which is a prompt injected directly into the agent's context — and nothing in the ecosystem today flags either event. Placard connects to an MCP server, enumerates its surface, emits a canonical hashed manifest, and fails CI when the next scan disagrees with the last one. **Placard never invokes a tool.** Enumeration and static analysis only. No code path may call `tools/call`; `scripts/check_no_tool_invocation.py` enforces that mechanically. ## Status: Phases 1 through 4 complete `scan` classifies every tool on the R0-R5 ladder — schema shape, tool name, description, and declared-annotation signals combine as a monotonic maximum (never a weighted score), reconciled against what the server declared about itself. Alongside the tier every tool carries a `kinds` se…
Mapped onto the structured taxonomy from declared text and observed tool names. Confidence shown for derived entries.
Every source is kept verbatim. Field changes are logged as events.