mcp-tester adds rug-pull detection, which is the failure mode install-time vetting can't catch.

Posted to HN August 9, mcp-tester is a self-hosted web inspector for any MCP server, reporting fetch latency with per-phase breakdowns and token estimates across providers. The security layer runs heuristic tool-poisoning checks for hidden Unicode, prompt-injection phrasing, and credential-exfiltration hints, plus rug-pull detection that flags when a server's tool definitions change between connections. It also grades tool definitions A–F on description quality and schema specificity. pip install remote-mcp-server-tester. Continuous verification beats install-time review for anything you don't control.