Lockfile and tool-poisoning scanner for MCP servers.
mcplock pins every MCP tool's name, description and schema into mcp.lock.json, the same way a package lockfile pins versions. Run mcplock check in CI, on a schedule, or before a session: if any tool text changed, it fails and shows the diff. It also scans the tool text for patterns documented in tool-poisoning attacks.
Problem
An MCP server can change what it tells the model after you approved it. A tool that had a harmless description last week can start telling the model to read ~/.ssh/id_rsa and not mention it. The client shows nothing, and the model reads that text on every call.
Approach
mcplock connects to every configured server over stdio, Streamable HTTP or SSE, and writes each tool's surface to a lockfile. It reads Claude Desktop, Claude Code, Cursor, VS Code and project .mcp.json configs automatically. A check reconnects, diffs against the lock, and runs text heuristics for instruction overrides, concealment, credential paths, hidden <IMPORTANT> tags, invisible Unicode and references to other servers' tools. Exit codes separate drift, poisoned text and connection errors, so CI can act on each.
Selected features
- mcp.lock.json with every tool's name, description and schema
- check exits non-zero on drift and prints a readable diff
- Offline scan of locked tool text for tool-poisoning patterns
- Auto-discovers Claude Desktop, Claude Code, Cursor, VS Code and .mcp.json configs
- Stdio, Streamable HTTP and SSE transports
- Runs in CI as a single bunx command
Tech
Open source, MIT licensed. Runs on Bun; Node support is planned. Snyk's MCP-Scan covers similar ground with more checks; mcplock is a small, local-only take on the lockfile part.