Look twice.Find the gem.

AI agents and MCP servers, each published with its source and what the checks found.

Marketplace

  • Everything
  • AI agents
  • Apps
  • MCP servers
  • Templates
  • What people want
  • What changed this week
  • The verification standard
  • The ooruby Index
  • Servers that publish no source
  • Reliability guides
  • What the catalogue holds
  • Sell here

Our library

  • Everything, in one place
  • Guides
  • Glossary
  • Calculators
  • Checklists and cheat sheets
  • Community

ooruby

  • Home
  • For teams
  • Site status
  • Company projects
  • RSS feed

Verification records what our published tests found on a specific version at a specific date. It is not a warranty, and it does not certify that software is free of defects.

AI agentsAppsMCP serversTemplatesWantedCommunityOur library
Sign inSell
Catalogue/MCP servers/MCP Toxic Flow Auditor

MCP Toxic Flow Auditor

guardbee · MCP server

Audits an MCP tool catalogue for toxic flows: tools that fetch untrusted content, tools that reach private or sensitive data, and tools that can send data out or destroy it, all on the same server. It flags the full combination, single tools that span all three, and risky pairs, reading tool names word by word. Results are graded from A to F. It analyses catalogues and source only, never calls live tools, and needs no API key.

Written by ooruby from the README of @guardbee/mcp-toxic-flow-auditor 0.1.14.

Not claimed by its maker. Is this yours? Prove it and answer the findings

Why it's useful

Shows which MCP servers put untrusted input, private data and an outbound path together, where one prompt injection could chain them.

What you could do with it

  1. 1Run an audit on a JSON dump of a server's tools list and read the grade it gives.
  2. 2Scan a directory of MCP server source to find its tool registrations and flag risky combinations.
  3. 3Check whether a single tool's name and description alone span untrusted content, sensitive data and exfiltration.

Written from its documentation: what it says it can do, not what our checks found.

TFMCP serverDeveloper tools

Maintenance

Not measured

No release date is on record for this package yet. The nightly publisher check records one as it reaches each npm package, about once every ten nights.

Release activity only: it says nothing about quality or safety, and a finished small package can be fine without releases. How it is measured

Not yet tested
Licence and provenance
finding
no LICENCE file at the root (.)

Published because it was found. A finding is information about where the limits are, not a verdict that the software is unsafe.

What this does not cover

  • ·Everything. Treat it as you would software from anywhere else.

Receipt history: every signed receipt for every version of this listing, and what changed between them.

In its maker's words

MCP server that detects toxic flows (lethal trifecta) across an MCP tool catalog — untrusted content + private/sensitive data + exfiltration or destruction on the same server

Compare with

  • Agent Deviceside by side
  • MCP Gitlabside by side
  • Metaharnessside by side
Compare all 4

How far this has been checked

Static scanned

What it establishes
Its published package, or for a hosted server its source repository at a recorded commit, was read file by file, without running it, by every check in our current scan.
What it does not
How it behaves when it runs, or anything the scan does not read yet: several rubric checks, the repository's history, and compiled code in folders named dist or build. For a hosted server, that the endpoint runs the code that was read. The ooruby Index sets out exactly what was read.
Exactly what was read
Version 0.1.14, the file with digest sha512-NPpG5ZkQ/m60fdtFUY0RUdQqXZLh0S8KB7Kl2bGYIMuhnJWXhoEO6yboN8Zci3LNZEksZuTk2ZlhSLmKAkrDWA==, as the registry publishes it. A published version cannot be replaced, so this names the same bytes for anyone who checks.
Authentication
Runs locally. No hosted endpoint is listed for this package. You run it on your own machine, so there is no endpoint of ours to authenticate against.
How the rungs work

Adding it

Paste this into your client's MCP configuration.

{
  "mcpServers": {
    "guardbee-toxic-flow-auditor": {
      "command": "npx",
      "args": [
        "-y",
        "@guardbee/mcp-toxic-flow-auditor@0.1.14"
      ]
    }
  }
}

Or run it directly.

npx -y @guardbee/mcp-toxic-flow-auditor@0.1.14

Pinned to 0.1.14, which is the version the findings above were found in. Drop the version to take whatever is newest, and the report on this page stops describing what you installed.

Where this came from

Registry
npm
Package
@guardbee/mcp-toxic-flow-auditor
Version read
0.1.14
Resolved
2026-10-10
Open the source(opens in a new tab)

Built from source, attested

npm publishes a signed statement that this exact package was built from the repository below, at this commit. It is verifiable without taking our word for it.

Repository
github.com/guardbee/guardbee-mcp
Commit
9735ef29a3ce
Built by
github.com/actions/runner/github-hosted
Registry publish attestation
signed by npm · 2026-10-10
Checked
2026-10-10

The badge, if this is your listing

It renders the current rung (static scanned) and links back here, where what that does and does not establish is one click away. It updates itself as the evidence deepens.

[![ooruby: static scanned](https://ooruby.com/api/badge/guardbee-mcp-toxic-flow-auditor)](https://ooruby.com/market/guardbee-mcp-toxic-flow-auditor)

About this listing

Kind
MCP server
Category
Developer tools
Pricing
Free
Sandbox
No
Hosted
No
Updated
2026-10-09
Price
Free
Get it freeVisit maker
Rating
no reviews yet
0 want this so far
Sign in to vote

Sign in to watch this listing and hear when its version, rung or findings change.

More from guardbee

See the storefront
DIMCP serverInfrastructure
1 findingStatic scanned
Four tools list A, AAAA, MX, NS, TXT, CNAME and SOA records, probe common subdomains, run a combined email security audit with fix suggestions and look up one record type. A command line mode can fail a CI job on findings.

MCP Dns Intelligence

guardbee
Free

Lets your AI assistant audit a domain's DNS, SPF, DMARC and DKIM records and flag dangling subdomains.

1.5k installs/moMIT
PIMCP serverDeveloper tools
1 findingStatic scanned
Checks content against 17 patterns in five categories: instruction override, role spoofing, hidden text, direct address to the AI and data exfiltration. Each finding comes with a recommendation.

MCP Prompt Injection Scanner

guardbee
Free

Lets your AI assistant scan documents, scraped pages and RAG chunks for indirect prompt injection.

1.2k installs/moMIT

Similar MCP servers

All MCP servers
STMCP serverDeveloper tools
2 findingsStatic scanned
A library rather than a ready-made server: it builds an HTTP handler whose tools list your components, show a component's docs and show a single story, read from Storybook manifests.

Storybook MCP

storybook
Free

Adds Storybook component and story documentation tools to an MCP server you run yourself.

9.4M installs/moMIT
CDMCP serverDeveloper tools
Clean scanStatic scanned
Uses Puppeteer to act in the page and wait for results. It turns performance traces into insights, analyses network requests, takes screenshots and shows console messages with source-mapped stack traces.

Chrome Devtools MCP

mathias
Free

Lets your agent control and inspect a live Chrome browser using Chrome DevTools.

9.9M installs/moApache-2.0
COMCP serverDeveloper tools
Clean scanStatic scanned
One tool resolves a library name to an identifier and another fetches the documentation for it, optionally focused on a topic and fetched page by page. An API key raises rate limits and adds private repositories.

Context7 MCP

upstash
Free

Pulls version-specific library docs and code examples straight into your agent's context.

3.9M installs/moMIT

Verification records what our published tests found on a specific version at a specific date. It is not a warranty, and it does not certify that software is free of defects.