mcp-warrant
An auditor that lists any MCP server on the raw wire, calls each tool with inputs its schema allows and forbids, and reports each broken promise with the spec line it rests on.
- Year
- 2026
- Kind
- Security · Python
- Status
- Shipped
An MCP server advertises a contract: a JSON Schema for each tool's input and output, a stable tool list, cache hints. Nothing in the ecosystem checked whether an arbitrary server keeps it. mcp-warrant reads the raw wire, validates the schemas, calls each tool with inputs its schema allows and inputs it forbids, and checks results against the output schema.
Severity follows the spec's own words: a broken MUST is a FAIL, a broken SHOULD is a WARN, and a check that could not run says why. A diff command compares two audits and keeps real regressions apart from changes in coverage. A deliberately broken mock server, one defect per finding class, runs the whole demo offline.
On six real targets, most early findings were the auditor's own blind spots, each fixed with a regression test. What survived includes an example server that accepted 7 of 7 inputs its own schema forbids. Auditing means calling tools with generated arguments, which has side effects, so it should be pointed at a sandbox.
