warden
warden scans an MCP server's tool manifest, or untrusted text your agent received, for instructions hidden from you but read by the model.
vulkro-live warden ./tools.json # an MCP tool manifest
vulkro-live warden --result ./tool-output.txt # untrusted text
curl -s https://example.com/page | vulkro-live warden --result -
$ vulkro-live warden ./tools.json
HIGH send_report prompt-injection the text contains an instruction-injection phrase: "do not mention"
MEDIUM read_file tool-shadowing tool name 'read_file' matches a common builtin and may shadow it
MEDIUM send_report tool-poisoning the text tries to steer the model: "before calling any other"
LOW send_report capability the text mentions powerful capabilities; confirm they are expected
4 finding(s): 1 HIGH, 2 MEDIUM, 1 LOW, 0 INFO
A manifest can be a tools/list result, an array of tools or one tool. warden reads only text: it never runs code, and manifest mode makes no network calls.
What it checks
| Check | Catches |
|---|---|
prompt-injection, tool-poisoning | Instructions or steering text in tool names and descriptions |
hidden-unicode | Invisible characters that hide text from a human reviewer |
tool-shadowing | Tool names that copy a built-in or another tool |
| Cross-tool triggers | A tool telling the model to always call another tool first |
sensitive-parameter | A tool that asks the model for secrets |
capability | Powerful or risky behaviour |
Both modes also catch terminal escape sequences and ways to smuggle data out (look-alike hosts, image URLs, long encoded strings).
Flags
| Flag | Effect |
|---|---|
[FILE]... | Manifests to scan; with --result, text files (none or - reads stdin) |
--result | Scan untrusted text instead of a JSON manifest |
--format <FORMAT> | text (default), json or sarif |
Exit codes: 0 nothing actionable, 1 a HIGH or MEDIUM finding, 2 error.
To pin a manifest you approved and catch later changes, use lock and drift.