Is an MCP server trying to trick your AI?
Faintprint reads the tool lists of the MCP servers your AI tools are connected to, and tells you for each one whether it shows signs of an attack and how much it can do. It runs on your machine or in your build pipeline. The tool sends nothing to us.
One line per server: may we use it?
- Do not use
- Do not use until checked
- Check before use
- Not finished
- No signs of an attack
Each with one sentence of what to do.
Under the line, two ratings. Signs of an attack — hidden instructions in tool descriptions, encoded or invisible text, look-alike names, tampering: No signs found · Minor · Suspicious · Likely attack. What it can do — files, shell, network, secrets: Limited · Moderate · High.
Every finding shows the sentence
Each finding quotes the exact sentence from the server's own text, so a person can check it in seconds. Borderline sentences can be read by an AI reviewer on your own Anthropic key, for cents, only after the price is shown and you say yes.
It fails your build
The run ends with one answer a pipeline can read: 0 pass, 1 a server shows signs of an attack, 2 could not run, 3 not finished. A ready-made step for GitHub Actions and GitLab CI keeps the reports and ends the job with that code. On GitHub, the findings can also go to your repository's Security tab (free on public repositories; a private one needs GitHub Code Security).
An example
This report is about a server that does not exist. We wrote its tool list to show a known kind of attack: a date formatter whose description tells the AI to read your SSH key and pass it along. Faintprint's answer: Do not use.
What it is not
Not a hosted service: it runs on your machine, and the only thing that ever leaves it is the servers' own tool text, sent to Anthropic for the AI review, after your yes. Not a monitor: one scan is one moment. Not a runtime guard: it reads what a server says, not what it does when called. It never starts a server on your machine and never calls a tool.