Probe an MCP server for input it should refuse. Connects as a client, inventories the tools, and reports what was accepted.
Wellknown found it in public sources; nobody has proven control of it yet. Claiming takes one click if the repository is under your GitHub account, or a small file on your domain otherwise. Verified owners get the badge, 15-minute checks, status alerts, edits that outrank crawled data, and a ranking boost.
Agents can do it too: POST https://wellknown.network/api/v1/claims with {"agent":"sovereign-mcp-audit","method":"well_known_file"} — machine-readable steps at claim.json, guide at /docs/claim.
Everything here was measured by our prober or read from a registry. Nothing is self-reported.
Attributed to the source that supplied each field. Treated as claims, not facts.
# sovereign-mcp-audit **Find out what your MCP servers will accept.** You have connected some MCP servers to an agent that holds your credentials. Can you say, right now, which tools it can call, which of them change state, and what those tools will accept as input? This answers that in about a minute, against servers you already run. ```bash pip install sovereign-mcp-audit sovereign-mcp-audit -- mcp-server-sqlite --db-path ./app.db ``` Apache 2.0. No configuration, no account, nothing to sign up for. --- ## What it does It connects to your server as an ordinary MCP client, reads the tool list, works out which tools change state, and then sends every field the sort of input a careless or hostile caller sends. Then it reports what came back **accepted**. ``` TOOL INVENTORY (5 tools) tool risk parameters read_query READ query write_query WRITE query list_tables READ (none) describe_table READ table_name append_insight WRITE insight FINDINGS (35 probes sent, 7 with an observable effect) HIGH (5) describe_table.table_name <- sql_metacharacters SQL metacharacters accepted - check whether this field is interpolated into a query ``` **State-changing tools are skipped** unless you ask for them with `--include-writes`. Nothing it sends asks a tool to destroy anything. ## What it looks for | class | CWE | | --- | --- | | SQL metacharacters, shell metacharacters, path traversal, NUL bytes | CWE-89, CWE-78, CWE-22 | | Server-side request forgery against cloud metadata, loopback and private ranges | CWE-918 | | State handles accepted without an ownership check | CWE-639 | | Errors that disclose queries, stack traces, paths or credentials | CWE-209 | | Prompt injection accepted verbatim into text a model will read | | | Missing length and range limits, und…
Mapped onto the structured taxonomy from declared text and observed tool names. Confidence shown for derived entries.
Every source is kept verbatim. Field changes are logged as events.