Documentation

Preflight v0.1 — free during preview.

Overview

Preflight checks an MCP server for real risk signals before an agent connects to it, without a human in the loop. Every check below runs against structure and behavior, not vibes — no check ships until it's been run against known-good and known-bad reference cases with no false positives.

REST API

POST /api/scan

Scan a live server or a manifest directly.

curl -X POST https://preflight.allthepossibles.com/api/scan \
  -H "content-type: application/json" \
  -d '{"url": "https://example.com/mcp"}'

Body — exactly one of:

Response is a ScanReport: riskScore (0-100), verdict (clear / caution / high-risk), and a findings array, each with severity, category, title, and detail.

GET /api/stats

Aggregate counts across every scan run through Preflight — total scans, verdict breakdown, how many hit unauthenticated transport. Powers the public numbers Preflight cites about itself.

GET /status

Live health check — database connectivity and reachability of the (currently disabled) semantic-scan dependency. Returns 200 with {"status": "operational" | "degraded"}.

MCP server

Streamable HTTP, one POST endpoint, one tool.

{
  "mcpServers": {
    "preflight": { "url": "https://preflight.allthepossibles.com/mcp" }
  }
}

scan_mcp_server takes the same input shape as /api/scan and returns the report as JSON text content.

Findings & scoring

Severity weights: critical (34), high (18), medium (9), low (4), info (0) — summed and capped at 100. clear is under 12, caution is 12–39, high-risk is 40+.

Capability-overreach findings escalate to critical automatically when the tool's input schema has no enum/pattern constraint on the relevant field — an unscoped grant is worse than a scoped one, and the score reflects that.

Rate limits

20 scans/minute per caller IP during preview, tracked in the same database every scan already writes to. A 429 means you've hit it — back off, don't retry immediately. This exists to keep the free tier standing while nothing's monetized yet; it isn't meant to block legitimate use, so say something if it's getting in your way.

Known limitations

Ruleset v1 is intentionally small and expands weekly — false negatives on novel attack patterns are expected, not a surprise. If you find one, that's the single most useful thing you can report right now.

Live-URL scanning can't test itself against another Worker on *.workers.dev — that's a Cloudflare platform restriction on workers.dev-to-workers.dev fetches, not a bug, and doesn't affect scanning real third-party servers.

The semantic prompt-injection check is built and tested but disabled by default (see the table above) — it calls the Claude API per scan, which isn't something to run for free with no billing in front of it yet.

Why the source isn't here

Preflight's actual code is closed. That's a deliberate call, not an oversight: the value of a security scanner depends partly on not publishing the exact patterns it checks for — the same reasoning every open security tool eventually runs into, from antivirus signatures to WAF rulesets. Publish the detection logic verbatim and you've also published a guide to writing a tool description that slips past it.

What's open instead is everything that doesn't create that risk: this documentation, the methodology above, the aggregate numbers Preflight publishes about itself, and a public repo for issues and discussion. Report a false positive or false negative there — that's the most useful signal we can get, and it doesn't require seeing the ruleset to give it.

Support

Found a false positive, a false negative, or something broken: open an issue — that's the fastest way to reach a real person.