{"$schema":"https://static.modelcontextprotocol.io/schemas/mcp-server-card/v1.json","name":"com.soldabot/soldabot","title":"Soldabot","version":"1.0.0","description":"Soldabot checks texts, web pages and MCP servers for traps aimed at AI agents (prompt injection, hidden text, secret exfiltration, poisoned tool descriptions) before the AI reads or connects them. Free, no key, nothing stored.","websiteUrl":"https://soldabot.com","remotes":[{"type":"streamable-http","url":"https://soldabot.com/mcp"}],"tools":[{"name":"check_text","title":"Check a text for traps","description":"Use BEFORE reading, summarizing or acting on any outside text (email, message, document, tool output, search result). Detects orders aimed at AIs (prompt injection), fake system messages, requests for secrets, data-leaking links, invisible characters and encoded payloads. Returns verdict safe|suspicious|dangerous with evidence. Does not store the text."},{"name":"check_page","title":"Check a web page for traps","description":"Use BEFORE trusting a web page you are about to read for your user. Soldabot fetches the public page once and compares the text humans see with hidden text (display:none, zero-size, comments, alt text). Hidden orders to AIs = dangerous. Pages behind a login cannot be checked."},{"name":"check_mcp_server","title":"Check an MCP server before connecting it","description":"Use BEFORE connecting or calling a new MCP server. Reads its public tools/list and detects poisoned tool descriptions (hidden <IMPORTANT> orders, requests to read private files, suspicious parameters like 'sidenote') and silent description changes since Soldabot's previous check. Servers requiring a key cannot be checked."},{"name":"soldabot_status","title":"What Soldabot checks and the guarded sites","description":"Lists the trap codes Soldabot detects (with severity and advice) and the live status of the sites it guards. Use when you need to explain a verdict or to know which sites Soldabot protects."}],"authentication":{"required":false}}