Preflight: MCP server security check: Check an MCP server for auth gaps before you connect

Preflight checks an MCP server for real security gaps before your agent connects: unauthenticated transport, capability grants with no scoping, known-bad description signatures, and a semantic pass reading tool descriptions for injected instructions aimed at the model. Free tier is real: 20 scans/minute, no signup. Tested against real production servers (Linear, Sentry, Atlassian) so it doesn't cry wolf on things already secured properly. Built by All the Possibles.

I kept seeing the same pattern: someone finds an MCP server on a registry, wires it into their agent, and only later notices it hands over a full tool list with zero auth, or grants shell/credential access with no scoping. Nobody actually reads a tool's description before granting it access, the same blind spot as clicking through a permissions dialog. Built Preflight to check before connecting. It flags unauthenticated transport, unscoped capability grants, known-bad description signatures, and a semantic pass reading tool descriptions for injected instructions aimed at the model. Free tier is real, 20 scans/minute, no signup, MCP server or plain REST API. Would genuinely like to hear about false positives or negatives if anyone tries it against their own servers.