Scan any MCP server for prompt injection and tool poisoning free. Subscribe when you want to gate CI and watch your servers continuously.

Free

No signup

Scan any server in your browser — paste tools/list (private/local stays private) or scan a public URL
Verdict: clear · review · block, with risk score and severity counts
Live README badge that re-scans every six hours
Per-server trust reports you can share and link

Pro

$9.99 /month

Pay by card · cancel anytime

API key with 100 scans / month across every Grey Ridge endpoint
Full audit detail: which tool, the exact injected text, OWASP LLM01/LLM08 mapping and remediation
Gate CI on the verdict — the GitHub Action fails the build on block
Continuous re-scans so a server that was clean can't drift to poisoned unnoticed
No wallet, no crypto — Stripe checkout, key shown on the success page and at /api-key

Prefer no account at all?

Agents pay per call over x402 (USDC on Base) with no signup and no API key — $0.05 per MCP scan, $0.001–$0.01 for the on-chain data and token-safety routes. See the machine-readable catalog or the full endpoint list.

Questions

Is my server data stored? No. The scanner reads only the advertised tool metadata you give it, once, against a read-only endpoint — it never invokes a tool and never stores the input, so private and localhost servers stay private.

What exactly does a scan catch? Concealed instructions (including contraction-phrased "don't tell the user" variants), data-exfiltration hints, dangerous capabilities, cross-tool shadowing, and invisible-unicode payloads — the tool-poisoning attack class.

Simple pricing for MCP security

Free

Pro

Prefer no account at all?

Questions