> ## Documentation Index > Fetch the complete documentation index at: https://docs.promptguard.co/llms.txt > Use this file to discover all available pages before exploring further. # Scan Mcp Manifest > Scan an MCP server's tool list for poisoned descriptions and pin it. Finds instructions injected into tool descriptions and parameter docs, invisible or look-alike Unicode, and tool names that shadow another of the agent's servers. Returns the list's pin, and a rug-pull finding when it no longer matches the `pin` sent. Counts one request against the plan. ## OpenAPI ````yaml /api-reference/openapi-developer.json post /api/v1/mcp/manifest-scan openapi: 3.1.0 info: title: PromptGuard Developer API description: >- Public API for developers to integrate PromptGuard security into their applications version: 1.0.0 servers: - url: https://api.promptguard.co description: Production security: - ApiKeyAuth: [] paths: /api/v1/mcp/manifest-scan: post: tags: - mcp summary: Scan Mcp Manifest description: >- Scan an MCP server's tool list for poisoned descriptions and pin it. Finds instructions injected into tool descriptions and parameter docs, invisible or look-alike Unicode, and tool names that shadow another of the agent's servers. Returns the list's pin, and a rug-pull finding when it no longer matches the `pin` sent. Counts one request against the plan. operationId: scan_mcp_manifest_api_v1_mcp_manifest_scan_post parameters: - name: x-api-key in: header required: false schema: anyOf: - type: string - type: 'null' title: X-Api-Key requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/ManifestScanRequest' responses: '200': description: Successful Response content: application/json: schema: $ref: '#/components/schemas/ManifestScanResponse' '401': description: Missing or invalid API key content: application/json: schema: $ref: '#/components/schemas/AuthErrorEnvelope' '403': description: Refused by a project access list content: application/json: schema: $ref: '#/components/schemas/ErrorEnvelope' '422': description: Validation Error content: application/json: schema: $ref: '#/components/schemas/HTTPValidationError' '429': description: Monthly quota exceeded content: application/json: schema: $ref: '#/components/schemas/QuotaErrorEnvelope' components: schemas: ManifestScanRequest: properties: tools: items: $ref: '#/components/schemas/McpTool' type: array maxItems: 500 title: Tools description: >- The server's `tools/list` result: the `tools` array, sent as the server returned it. At most 500 tools, and 131072 characters of canonical JSON together with every name in `other_servers`. pin: anyOf: - type: string pattern: ^[0-9a-f]{64}$ - type: 'null' title: Pin description: >- The `sha256` an earlier scan of this server returned. Omit it the first time; when it differs from this list's `sha256`, the response carries a `E301` finding. other_servers: items: $ref: '#/components/schemas/McpOtherServer' type: array maxItems: 50 title: Other Servers description: >- The agent's other MCP servers, for shadowing: a tool here whose name one of them already has is a `E002` finding. Only their tool names are read, and they are not scanned themselves. type: object required: - tools title: ManifestScanRequest ManifestScanResponse: properties: sha256: type: string title: Sha256 description: >- This tool list's pin: send it as `pin` on the next scan of this server. Treat it as opaque. ok: type: boolean title: Ok description: >- False when any finding's severity is `high`, or the scan is incomplete findings: items: $ref: '#/components/schemas/ManifestFinding' type: array title: Findings tools: items: $ref: '#/components/schemas/ToolHash' type: array title: Tools description: >- Each tool's own hash, in the order sent, so a caller that keeps them can tell which tool changed. Not part of `sha256`. Opaque, like it. incomplete: type: boolean title: Incomplete description: >- True when the scan ran out of its detection budget before its last tool. The tools it did not reach are in `unscanned_tools`; `sha256` and the rug-pull comparison are still complete. unscanned_tools: items: type: string type: array title: Unscanned Tools description: Names of the tools not scanned, in the order sent type: object required: - sha256 - ok - findings - tools - incomplete - unscanned_tools title: ManifestScanResponse AuthErrorEnvelope: properties: error: $ref: '#/components/schemas/ErrorDetail' examples: - code: missing_api_key message: >- PromptGuard API key required. Please provide via X-API-Key header. type: authentication_error type: object required: - error title: AuthErrorEnvelope ErrorEnvelope: properties: error: $ref: '#/components/schemas/ErrorDetail' type: object required: - error title: ErrorEnvelope HTTPValidationError: properties: detail: items: $ref: '#/components/schemas/ValidationError' type: array title: Detail type: object title: HTTPValidationError QuotaErrorEnvelope: properties: error: $ref: '#/components/schemas/QuotaErrorDetail' type: object required: - error title: QuotaErrorEnvelope McpTool: properties: name: type: string maxLength: 256 minLength: 1 title: Name description: anyOf: - type: string - type: 'null' title: Description inputSchema: anyOf: - additionalProperties: true type: object - type: 'null' title: Inputschema description: >- The tool's JSON Schema for its arguments. `input_schema` is accepted too. type: object required: - name title: McpTool description: One entry of an MCP ``tools/list`` result. Other keys are ignored. McpOtherServer: properties: name: type: string maxLength: 256 minLength: 1 title: Name description: Named in a shadowing finding tools: items: $ref: '#/components/schemas/McpToolName' type: array maxItems: 1000 title: Tools type: object required: - name - tools title: McpOtherServer ManifestFinding: properties: code: type: string title: Code description: >- `E001` instructions injected into a description or parameter doc; `W021` invisible or look-alike characters; `E002` a name or reference that shadows another server's tool; `E003` an ATR community rule matched (advisory); `W022` two tools share a name, ignoring case; `E301` the list changed since `pin`; `E900` one tool could not be scanned, and was not. tool: type: string title: Tool description: The tool's name, or `*` for the list as a whole severity: type: string title: Severity description: '`high`, `medium` or `info`' reason: type: string title: Reason details: additionalProperties: true type: object title: Details type: object required: - code - tool - severity - reason title: ManifestFinding ToolHash: properties: name: type: string title: Name sha256: type: string title: Sha256 type: object required: - name - sha256 title: ToolHash ErrorDetail: properties: message: type: string title: Message description: Human-readable error description type: type: string title: Type description: Error category, e.g. 'authentication_error' code: type: string title: Code description: Machine-readable error code type: object required: - message - type - code title: ErrorDetail ValidationError: properties: loc: items: anyOf: - type: string - type: integer type: array title: Location msg: type: string title: Message type: type: string title: Error Type input: title: Input ctx: type: object title: Context type: object required: - loc - msg - type title: ValidationError QuotaErrorDetail: properties: message: type: string title: Message type: type: string title: Type description: '''quota_exceeded'' or ''spending_limit_exceeded''' code: type: string title: Code description: '''monthly_quota_exceeded'' or ''spending_limit_exceeded''' current_plan: type: string title: Current Plan requests_used: type: integer title: Requests Used requests_limit: type: integer title: Requests Limit upgrade_url: type: string title: Upgrade Url retry_after: anyOf: - type: integer - type: 'null' title: Retry After type: object required: - message - type - code - current_plan - requests_used - requests_limit - upgrade_url title: QuotaErrorDetail McpToolName: properties: name: type: string maxLength: 256 minLength: 1 title: Name type: object required: - name title: McpToolName description: 'A tool on another server: only its name is read. Other keys are ignored.' securitySchemes: ApiKeyAuth: type: apiKey in: header name: X-API-Key description: >- PromptGuard API key for developer endpoints. Keys start with pg_live_ and are created in the dashboard. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.