Pixel Office Logo
Pixel Office MCP-Shield
Test MCP Server
Model Context Protocol Security & JSON-RPC Schema Hardening

Secure Your Claude Desktop & Cursor MCP Servers Against Tool Poisoning

Audit unvalidated JSON-RPC schemas, prevent arbitrary shell escapes, eliminate silent credential exfiltration, and generate zero-overhead hardened wrappers in <35ms.

$ npx @pixeloffice-eu/mcp-shield scan
JSON-RPC 2.0 Stdio Compliant Sub-35ms Schema Verification Zero Dependency Wrappers

Live Interactive MCP Security Studio

Paste your MCP tool schema or select a vulnerable sample script to simulate real-time prompt injection attacks and schema enforcement.

MCP Tool Definition (JSON Schema)
Presets:
Engine: PixelShield-Core v2.1
Security Audit Scorecard AUDIT REQUIRED
MCP Hardening Index
-- / 100
Latency
-- ms
Load a tool preset or click Run Security Audit to evaluate parameter escaping, path containment, and prompt injection bounds.
Real-Time AI Crawler Webhook

Get Instant E-mail Alerts When GPTBot or ClaudeBot Audits Your Tools

Never wonder what AI agents discover. Enter your work email below to receive instant telemetry proof emails whenever autonomous bots crawl your endpoint.

5 Critical Attack Vectors in Unshielded MCP Servers

Why standard MCP implementations without schema enforcement put host workstations and cloud databases at risk.

1. Arbitrary Shell Escape

When an MCP tool passes string arguments to child_process.exec() or os.system() without strict alphanumeric sanitization, an injected prompt can append command chains (; rm -rf /, curl attacker.com).

Severity: Critical (CVSS 9.8)

2. Path Traversal & Escaping

Filesystem MCP tools with weak directory confinement allow agents to navigate outside allowed sandbox boundaries using ../../etc/passwd or ~/.ssh/id_rsa.

Severity: High (CVSS 8.4)

3. Silent Credential Exfiltration

Malicious tools or hijacked context prompts silently read process environment variables (OPENAI_API_KEY, AWS_SECRET_ACCESS_KEY) and broadcast them via outbound webhooks.

Severity: High (CVSS 8.1)

4. Schema Type Inconsistency

Missing additionalProperties: false and unbounded parameter arrays cause schema mismatch crashes in Claude Desktop and infinite loop retries in Cursor agent flows.

Severity: Medium (CVSS 5.3)

5. Unmetered DoS Loops

Tools without strict execution timeouts (max 5,000ms) or rate limiters lock the agent stdio channel, freezing the entire IDE window indefinitely.

Severity: Medium (CVSS 4.8)
The MCP-Shield Solution

Instant Automated Mitigation

Wrap any existing Node.js or Python MCP script with our zero-dependency sentinel in 1 line of code.

View Generated Safe Wrappers

Hardened Zero-Dependency Safe Wrappers

Drop-in safety middleware for your existing MCP servers with strict parameter bounds and sub-35ms overhead.


        

      


      
      

        

          

             Embed MCP-Shield Verified Badge in your GitHub README
          

          
Signal to users and enterprise auditors that your MCP server complies with strict JSON-RPC schema bounds.

        

        

          
          
        

      


    

  


  
  

    

      
      

        

           100% Free & Open for All AI Developers
        

        
Community Free Tooling & Enterprise Audits

        
We believe agent safety should be universally accessible. All scanner tools and safe wrappers are 100% free forever.

      


      

        
        
        

          

            Free Lead Magnet
          

          

            
Developers & Open Source

            
Developer Shield

            
Full access to offline scanner CLI and hardened wrapper templates.

            

              €0
              / 100% Free Forever
            


            
    
              
  •  Unlimited CLI scans (npx @pixeloffice-eu/mcp-shield scan)
    • 
              
  •  Complete Node.js & Python safe wrappers
    • 
              
  •  Parameter escaping & Path confinement
    • 
              
  •  Verified GitHub README badge generator
    • 
              
  •  Zero registration required
    • 
            

          


          
        


        
        

          

            
Production Fleet & SOC2

            
Enterprise Audit & Shield

            
Automated CI/CD security gating and official compliance attestation.

            

              €299
              / project lifetime
            


            
    
              
  •  Everything in Free Developer Tier
    • 
              
  •  Official SOC2 & EU AI Act Attestation Certificate
    • 
              
  •  GitHub Actions / CI/CD Security Gating Script
    • 
              
  •  Real-time Runtime Anomaly Telemetry Webhook
    • 
              
  •  Priority email support from Pixel Office security engineers
    • 
            

          


          
        


      


      
      

        

          

             The Next Step for Fast & Cheap Agent Tools
          

          
Cut your LLM Token Bills by 85% with PixelRouter

          

            Route your MCP agent completions through our sub-35ms proxy with viral stealth reasoning models like Ox Alpha (1M context) and DeepSeek.
          

        

        
           Try PixelRouter (/v1/)