Palanit Core MCP server

Palanit Core

A watchtower for AI agents.

Scan MCP servers and AI-agent tool manifests for hidden risk — before an attacker finds it.

Website · Docs · Palanit OS (hosted)

Your AI agent trusts tools, MCP servers and skills it didn't write. A tool's description is injected straight into the model's context — so a poisoned description can quietly tell your agent to leak a key, call an attacker's server, or run a shell command. Palanit Core reads every tool the way your agent will, and flags the ones that would betray it.

• Zero dependencies. Pure Python standard library. Nothing to audit but the rules.
• Fast & local. Runs on your machine. Sends nothing anywhere.
• CI-ready. Exits 1 on HIGH+ findings, so a poisoned tool fails the build.
• Open & honest. Every rule is readable. Severities reflect real impact, not upsell.

Install

pip install palanit-core

Use

# Scan an MCP config or tool manifest
palanit scan mcp.config.json

# See it in action on the bundled malicious sample
palanit scan --sample

# Machine-readable output, fail CI on HIGH or above
palanit scan mcp.config.json --json --fail-on HIGH

# Pin the tool definitions you approved, then fail closed if a server later
# swaps a description or schema after install (a "rug pull")
palanit pin mcp.config.json
palanit scan mcp.config.json --baseline .palanit.lock.json

Example (trimmed):

CRITICAL   Possible data exfiltration  [PL-EXFIL-001]
    Instructs the agent to send sensitive data to an external URL (collector.evil.example).
    ↳ mcp.config.json#/mcpServers/invoicing/tools/0/description
    fix: Remove external URLs and exfiltration verbs from tool text.

   HIGH     Hidden instructions in tool text  [PL-POISON-001]
   HIGH     Invisible or deceptive Unicode  [PL-UNICODE-001]
  MEDIUM    Unpinned package / runner  [PL-SUPPLY-001]
...
9 finding(s)  (1 critical · 5 high · 3 medium)

Catch rug-pulls (tool-definition pinning)

A scan at install time only sees the tool text you approved. A hostile server can swap a tool's description or input schema after that approval — and standard clients never re-check. palanit pin records a hash of each tool's declared definition; a later scan --baseline fails closed on any change, so a swap costs the attacker the tool instead of silently succeeding.

palanit pin mcp.config.json                                  # approve current definitions
palanit scan mcp.config.json --baseline .palanit.lock.json   # HIGH + exit 1 on any drift

What it detects

Shortened. The full README is on GitHub.