All servers · Build & deploy

Preflight

com.allthepossibles/preflight · v1.0.0

New (7 days)Instruction-like text in descriptions

Measured by MCP Station

Last check	Reachable
Checked at	—
Check success 7 / 30 days	—
First-try success 30 days	—
Median response	—
Lookups 30 days	—
Authentication	No auth
MCP version	2025-06-18
Rank score	—
Declared risk	Read-only (all tools declare readOnlyHint)
Capabilities declared	tools
Tool definitions	4 tools · with description 100% · input schema is an object 100% · read/destructive hints 100%

Instruction-like text was found in scan_extension. This is a pattern match, not a verdict. What we look for

Scans an MCP server for security gaps before your agent connects. Free tier, no signup.

streamable-http · https://preflight.allthepossibles.com/mcp

claude mcp add --transport http preflight https://preflight.allthepossibles.com/mcp

{
  "mcpServers": {
    "preflight": {
      "url": "https://preflight.allthepossibles.com/mcp"
    }
  }
}

scan_mcp_server
Check an MCP server for real risk signals before trusting it: unauthenticated transport, capability overreach (filesystem/shell/credential access with no scoping), and known-bad signatures. Pass a live server URL, or a manifest of tool definitions if the server isn't reachable over HTTP. Semantic pr
scan_content
Check a document or web page for hidden instructions before an agent reads, summarizes, or acts on it: invisible Unicode, obfuscated payloads, and (on Pro) a semantic pass for prompt-injection phrasing aimed at the model instead of the human reader. Pass either a URL to fetch, or raw text you alread
scan_extension
Check a VS Code extension or a Claude Skill before installing or trusting it. For a VS Code extension (which runs with full Node.js access and no permission model to scope): publisher domain-verification status weighed against install count, and known-bad-signature checks on its description. For a C
check_output
Check a structured output you're about to return or act on for degenerate-answer patterns a schema check can't see: invalid JSON, a placeholder value ('TBD', 'N/A', 'unknown') where a real answer should be, an array of byte-identical items (a common symptom of a loop that never advanced), or an expe

Website · JSON · Text for agents · Registry updated 2026-10-19