Mcp Toolbox — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Mcp Toolbox (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Product/PM angle: A plug-and-play MCP tool server — add capabilities to any MCP-compatible agent (Claude Desktop, etc.) by registering pure-Python tools with zero boilerplate.
An MCP (Model Context Protocol) server exposing a growing library of agent tools: file search, reliability scoring, and prompt injection detection.
| Tag | Milestone | Status |
|---|---|---|
| m1 | Package scaffold, tool registry, repo_search tool, core tests | Done |
| m2 | reliability_score + redteam_scan tools, full test suite | Done |
| m3 | Config system, CLI (mcptb list/dump/serve), README, packaging | Done |
| m4 | Demo script, edge-case tests, manifest dump | Done |
pip install -e ".[dev]" # dev + tests
pip install -e ".[server]" # includes mcp SDK + pyyamlmcptb list # list registered tools
mcptb dump # JSON manifest of all tools
mcptb serve # start MCP server (requires [server] extra)Requires the `[server]` extra — install it first: ``bash pip install -e ".[server]"`This pulls in themcpSDK (the stdio transport) andpyyaml`.
Add to your Claude Desktop claude_desktop_config.json:
{
"mcpServers": {
"mcp-toolbox": {
"command": "python",
"args": ["-m", "mcp_toolbox.cli", "serve"],
"env": {}
}
}
}The server uses stdio transport (as required by the MCP spec) and registers every tool in the registry automatically. The mcp package is lazy-imported inside serve(), so the rest of the CLI (mcptb list, mcptb dump) works without the [server] extra installed.
repo_search(directory, keyword, file_pattern="*.py")Keyword search over a directory tree. Returns [{file, line_no, line}].
reliability_score(answer, context)Heuristic faithfulness score (0-1) for an answer vs. its context. Returns {score, details}.
redteam_scan(text)Detects prompt injection / jailbreak patterns. Returns {risk_level, flags, score}.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.