Security scanner for MCP tools

Find the tools that hurt before they hurt you.

Every MCP tool, proven at runtime. Nothing leaves the sandbox.

Paste a GitHub link to an MCP server. ToolPain runs it on a throwaway Vultr VM with no internet, calls every tool, and reports what each one really does versus what it claims.

Network blocked at runtime
gVisor sandbox
VM destroyed after every scan

GitHub repository (required)

Public repos only. Forks are compared against upstream automatically.

Branch or ref (optional)

Ticket number (optional)

Printed on the certificate so the record and the ticket point at each other.

Advanced toolpain account

Protocol (optional)

Scan brief (optional)

Steers generated launch/probe/oracle code. Never grants host access.

Package subdirectory (optional)

Skip LLM workdir pick and use this monorepo path.

Existing MCP URL (optional)

Scan an already-running HTTP or SSE server. Localhost HTTP, or public HTTPS. Private and metadata hosts are rejected.

Run in my own Vultr account

The scanner VM is billed to you instead of toolpain.

Try a demo

server-filesystem clean playwright-mcp powerful decoy-trap-server flagged

How it works

01Provision VMA fresh Vultr instance, tagged toolpain, firewalled with no inbound.
02BuildDependencies install in a separate build stage. The only stage with network.
03IsolateInternal-only network, gVisor runtime, DNS sinkholed, decoys planted.
04Probe every toolDiscover from runtime, flags, source and docs. Call each tool, trace everything.
05Destroy VMReport saved, instance deleted. Nothing persists.

Recent scans

Public results. Reports kept 7 days.

Repository	Verdict	Findings	When
andrew/playwright-mcp	Flagged	3	4 min ago
modelcontextprotocol/servers · server-filesystem	Clean	0	12 min ago
microsoft/playwright-mcp	Over-privileged	2	38 min ago
toolpain/decoy-trap-server	Flagged	4	1 hr ago