ToolGlass

Show what your agent actually sees. A local, offline-first Rust audit of the MCP tool surface your AI coding assistant (Claude Code, Cursor, Codex, VS Code, Cline, goose) exposes to the model: descriptions, env keys, approval states, poisoning signals, and exfiltration paths, before it runs them.

local-first · offline · detection-only · cross-client · single binary

English · 中文

---

ToolGlass is not another scanner. It is an Agent Visible Surface report: transparent, local, diffable, and packaged as a single Rust binary. Nothing is sent anywhere; no MCP server is executed unless you explicitly opt in with live introspection.

Status

Launch-ready Rust crate. ToolGlass currently ships config scanning across 6 clients, live tools/list introspection for stdio MCP servers, tool-poisoning detections (TG-101/102/103), a cross-server exfiltration flow graph, a safe demo, and terminal/Markdown/HTML/SARIF/JSON reports. The test suite covers the Rust core and the GitHub Action emits SARIF for code scanning.

Stack

• Rust crate: tool-glass
• Binary: tool-glass
• Reports: terminal, md, html, sarif, json
• Clients: Claude Code, Cursor, Codex, VS Code, Cline, goose
• Distribution today: prebuilt release binaries or source builds

Why

MCP tools are model-controlled: the agent can read tool descriptions and instructions that you never see in the client UI. ToolGlass prints exactly what is exposed, locally, so you can review it like a diff before trusting a third-party MCP server.

Unlike hosted scanners (e.g. Snyk Agent Scan / Invariant MCP-Scan), ToolGlass is open source, fully local, and offline: your tool descriptions never leave your machine. It prioritizes the explanation (an Agent Visible Surface report + an exfiltration path map) over hosted policy enforcement. Snyk is a broad commercial AppSec platform; ToolGlass is a small local lens focused on what AI agents can see and how tool descriptions can steer them.

Install

Download the prebuilt binary for your platform from Releases, extract the archive, and put tool-glass or tool-glass.exe somewhere on your PATH.

Or install from source with Cargo:

cargo install --path .
tool-glass --version

You can also build a release binary locally:

cargo build --release
./target/release/tool-glass --version

The local release build produces target/release/tool-glass on Unix-like systems and target/release/tool-glass.exe on Windows.

Quick start

Scan your local configs:

tool-glass scan
tool-glass scan --report json

Scan a specific project or config root:

tool-glass scan --cwd .
tool-glass scan --home /path/to/home --cwd /path/to/project

Write reports:

tool-glass scan --report md -o tool_glass.md
tool-glass scan --report html -o tool_glass.html
tool-glass scan --report sarif -o tool_glass.sarif

Live introspection is explicit:

tool-glass scan --cwd . --live --yes

Demo

See the attack with zero setup:

tool-glass demo

ToolGlass introspects two bundled fake MCP servers. A weather tool that looks harmless is revealed to hide a stealth instruction telling the model to read a private file and send it to a chat tool, and ToolGlass maps the get_weather -> send_message exfiltration path. Nothing is executed: the path is revealed, not run.

CI / GitHub Action

Audit MCP configs on every PR and surface findings in the Security tab.

Reusable action (for public repositories):

# .github/workflows/tool_glass.yml
name: tool_glass
on: [pull_request, push]
permissions:
  contents: read
  security-events: write
jobs:
  audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: Loping151/ToolGlass@main
        with:
          path: .
      - uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: tool_glass.sarif
          category: tool_glass

The composite action installs the stable Rust toolchain, builds ToolGlass with cargo build --release, runs:

target/release/tool-glass scan --cwd <path> --report sarif -o <sarif-path>

and exposes the SARIF path as the sarif output. This repository also ships its own workflow at .github/workflows/tool_glass.yml that runs cargo test, builds the release binary, scans the repo, and uploads SARIF. Findings annotate; they do not block by default.

Roadmap

• Config-only scan: Claude Code, Cursor, Codex, VS Code, Cline, goose
• Live tools/list introspection (stdio, restricted env, never calls tools)
• Tool-poisoning rules (TG-101/102/103) + cross-server exfil flow graph
• Reports: terminal, Markdown, HTML, SARIF, JSON
• GitHub Action with SARIF upload workflow
• Baseline diff (snapshot + compare; CI fails only on new high risks)
• More clients (Windsurf, Zed)
• crates.io package

Disclaimer

ToolGlass audits your own local configs only. By default it never executes an MCP server, never reads secret values (only env key names), and never touches the network. Live introspection is explicit and limited to listing tools from discovered stdio MCP servers.