Check it before your agent trusts it.

Preflight scans an MCP server the moment before your agent connects: whether it hands out access with no credentials, whether a tool grants more than it should, whether it matches a documented supply-chain incident.

Try it, paste a manifest

52%

of publicly audited MCP servers are abandoned. No maintainer, no fixes, still connectable.

Rapid Claw, 2026 audit of 1,847 servers

12,520

MCP servers found exposed to the open internet with no meaningful access controls. Anyone who finds the URL can act as a trusted caller.

Censys, April 2026

1,500

downloads a week, the run rate on the first documented malicious MCP package before anyone caught it silently forwarding every email through it.

postmark-mcp supply-chain incident

What it looks for

Capability overreach

A tool named "read a file" that actually accepts any path on the system isn't reading a file. It's reading your filesystem. Preflight checks whether a tool's input schema actually constrains what it can touch, or just claims to.

Transport

The server handed over its full tool list to a client with zero credentials, before anyone decided whether to trust it.

Prompt-injection surface , Pro

Phrasing in a tool's description written for the model reading it, not the person deploying it.

Known-bad signatures

Matches to documented supply-chain incidents, or an obfuscated payload hiding in plain text.

Extensions and skills have no permission model either

Nx Console, 2.2M installs

A compromised update to a trusted, widely-installed VS Code extension harvested GitHub, npm, AWS, Vault, Kubernetes, and 1Password secrets straight off developers' machines. Red Hat's own npm org was breached the same way. Roughly 90% of detected open-source malware now ships through npm, the channel a VS Code extension update rides in on. An extension runs with full Node.js access from the moment it's installed. There's no sandbox to scope, and nobody was checking before you clicked install.

VS Code extension

Publisher domain-verification weighed against install count: a hijacked or impersonating account looks exactly like this, high install count riding on a name nobody actually verified. scan_extension with a marketplaceId.

Claude Skill

Hidden instructions in the SKILL.md body, an allowed-tools grant wider than the skill's stated job, inline shell commands the file runs on load before anyone approves them, and bundled scripts checked for credential-exfiltration patterns. scan_extension with skillContent.

Wire it in

As an MCP server, so your agent calls it directly:

{
  "mcpServers": {
    "preflight": {
      "url": "https://preflight.allthepossibles.com/mcp"
    }
  }
}

Then call scan_mcp_server before wiring anything new into your agent's toolset.

Or hit the API directly:

curl -X POST https://preflight.allthepossibles.com/api/scan \
  -H "content-type: application/json" \
  -d '{"url": "https://example.com/mcp"}'

Pricing

Free

Transport, capability-overreach, and known-bad-signature checks. 20 requests/minute per caller IP. No signup.

Basic, $5/mo

Same checks as free. Just a higher ceiling: 150 requests/minute, for a script or agent that outgrows the free rate before it needs the semantic check. First 7 days free.

Pro, $19/mo

Everything free, plus the semantic prompt-injection check, and 500 requests/minute. First 7 days free.