Security
How the scanner works, and where it stops
Squatch analyzes MCP server metadata and configuration. It never executes tools. Here is precisely what it does, what it does not do, and the limits you should keep in mind.
What the scanner does
- Connects to public remote MCP endpoints over HTTPS (Streamable HTTP), negotiates a protocol version and lists the tools, resources and prompts the server advertises.
- Records exactly what was advertised: names, descriptions, input and output schemas, annotations and server information.
- Classifies each tool's effect (read, write, delete, admin, execute) and capabilities (email, payments, file access and so on) with a deterministic, versioned rule set, and explains every classification.
- Looks for hidden Unicode (zero-width, bidirectional and tag characters), lookalike publisher names and instruction-like text in metadata.
- Fingerprints every definition and compares it with the previous scan to detect added, removed, renamed and silently changed tools.
- Checks verification proofs: DNS TXT records, well-known files, repository ownership and registry namespace ownership.
What it does not do
- Call, invoke or execute any tool. Ever. Classifications come from metadata, not behavior.
- Send credentials, API keys or your data to the servers it scans. Scans are unauthenticated.
- Read resources or run prompts beyond listing what the server advertises.
- Connect to private, internal or reserved network addresses. Requests are resolved and pinned, redirects are limited and re-checked.
- Download or run packages. Package and stdio servers are described from registry metadata only.
- Certify a server as safe. A clean scan means we did not detect issues in what the server advertised at that moment.
Limits
- A server can behave differently from what its metadata says, or change between scans.
- Servers that require authentication expose little or nothing to an unauthenticated scan; we report these as incomplete.
- Classifications are heuristic. They can be wrong, and publishers can dispute them.
- We scan each endpoint within strict time and size limits; very large servers may be partially listed.
- Verification shows control of a domain, repository or identity at the time of the check. It is not an audit of the publisher.
How we protect this site
- Every page is served with a strict, per-request Content Security Policy.
- Text from MCP servers is rendered escaped, never as HTML or Markdown, with hidden characters made visible.
- Database access is governed by row-level security; secrets such as OAuth tokens are encrypted at rest.
- Only the isolated scanner talks to third-party endpoints. This website never fetches URLs you submit.
Reporting a vulnerability
If you find a security issue in Squatch MCP, email security@squatchmcp.com with steps to reproduce. Please give us reasonable time to fix it before disclosure, and do not access other people's data or degrade the service while testing. We will acknowledge reports promptly and credit researchers who want credit.
To report a problem with a listed MCP server (for example impersonation or malicious behavior), use the report option on that server's page.