ghostprobe: open-source red-team scanner for MCP tool poisoning and the 'lethal trifecta'

Dev|Journal (earezki.com)·low signal

Engineer Joe Munene released ghostprobe (discussed June 12, 2026), an open-source scanner that points at live MCP servers to detect tool-poisoning prompts and the 'lethal trifecta' (private data access + untrusted content + exfiltration capability) before integration into an agent stack. It joins a crowded but fast-moving MCP-defense tooling space (Cisco MCP Scanner, Snyk Agent Scan, Proximity), reflecting how MCP server vetting is becoming a standard pre-deployment step. Single-source dev-journal disclosure, so importance is rated low pending wider validation.