Security tools for AI agents: scan MCP servers, validate HDP delegation chains, audit releases.
Maintain this server? Claim it
Call this server's tools from your browser. Nothing to install.
Requests go through mcptry because browsers can't call most MCP servers directly. Header values are sent to the server for that request only and are never stored or logged.
Tool list from our last check. Connect live to refresh it.
Validate an HDP delegation chain against IETF draft-helixar-hdp-agentic-delegation-00. Surfaces scope escalations, depth violations, expired hops, missing signatures. Every output cites the IETF draft and Zenodo DOI.
This tool isn't marked read-only, so it may change something on the server or in an account you connected.
Validate an HDP delegation chain against IETF draft-helixar-hdp-agentic-delegation-00. Surfaces scope escalations, depth violations, expired hops, missing signatures. Every output cites the IETF draft and Zenodo DOI.
| Argument | Type |
|---|
| Description |
|---|
| chain* | object | |
| strict | boolean |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"chain"
],
"properties": {
"chain": {
"type": "object",
"properties": {
"hops": {
"type": "array",
"items": {
"type": "object",
"required": [
"delegator",
"delegatee"
],
"properties": {
"scope": {
"type": "array",
"items": {
"type": "string"
},
"default": []
},
"purpose": {
"type": "string"
},
"delegatee": {
"type": "string",
"minLength": 1
},
"delegator": {
"type": "string",
"minLength": 1
},
"signature": {
"type": "string"
},
"expires_at": {
"type": "string"
}
},
"additionalProperties": false
},
"default": []
},
"max_hops": {
"type": "integer",
"exclusiveMinimum": 0
},
"root_principal": {
"type": "string"
}
},
"additionalProperties": false
},
"strict": {
"type": "boolean",
"default": false
}
},
"additionalProperties": false
}Scan an MCP server (URL or raw manifest JSON) against Helixar's Sentinel detection rules. Returns risk score, findings, and a Claude-generated security brief. Quick mode is free + authless (top 8 rules); deep mode runs all 26 rules with an api_key.
| Argument | Type | Description |
|---|---|---|
| mode | string | |
| target* | string | MCP server URL or raw manifest JSON string |
| api_key | string | |
| context | string |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"target"
],
"properties": {
"mode": {
"enum": [
"quick",
"deep"
],
"type": "string",
"default": "quick"
},
"target": {
"type": "string",
"minLength": 1,
"description": "MCP server URL or raw manifest JSON string"
},
"api_key": {
"type": "string"
},
"context": {
"type": "string"
}
},
"additionalProperties": false
}