Open-source CLI scans MCP configs for poisoned tool descriptions before agents run them
StanislavMZ · reddit · 2026-10-17
A developer released palanit-core, a zero-dependency, local-only CLI that scans MCP server configs and tool manifests for dangerous patterns: hidden instructions, data-exfil URLs, invisible/bidi Unicode, hardcoded secrets, unpinned packages, shell-exec tools, non-TLS endpoints, and tool name collisions. Install via pip install palanit-core, run palanit scan mcp.config.json --fail-on HIGH. Apache-2.0, sends nothing anywhere, each rule is a few readable lines.
More from coding & agent
- Testing MiniMax Code for frontend design: daily check-in credits plus the Frontend Design skill — future_coded · 2026-10-17
- MemPalace gives coding agents local verbatim memory with 96.6% recall on LongMemEval — thisguyknowsai · 2026-10-17
- 'I built an agent and became its babysitter': a Reddit dev's honest realization — Luvena21 · 2026-10-17
- Dev builds a Gemini voice assistant that runs his Windows PC — lessons learned — 720beats · 2026-10-17
- Codex upgrades DSH and live-tests DeepSeek-V4.1-Flash 1017 — cedric_chee · 2026-10-17
- ArtCraft rebuilds Adobe suite in Rust: 13 open-source native apps, free — thisdudelikesAI · 2026-10-17