# Preflight (All the Possibles) [Health: Active]

**Category:** 🔒 Security  
**Repository:** https://preflight.allthepossibles.com/mcp  
**Views:** 0  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/preflight-all-the-possibles

## Description
Scans an MCP server for security gaps before an agent connects to it. Tools: scan_mcp_server, scan_content, scan_extension, check_output. Remote MCP endpoint at https://preflight.allthepossibles.com/mcp (Streamable HTTP) and a REST API. Free tier, no signup.

## Tools
Capabilities this server exposes over MCP:

- **scan_mcp_server** — Check an MCP server for real risk signals before trusting it: unauthenticated transport, capability overreach (filesystem/shell/credential access with no scoping), and known-bad signatures. Pass a live server URL, or a manifest of tool definitions if the server isn't reachable over HTTP. Semantic prompt-injection detection runs too if a Pro API key is sent as an Authorization: Bearer header, see /docs.
- **scan_content** — Check a document or web page for hidden instructions before an agent reads, summarizes, or acts on it: invisible Unicode, obfuscated payloads, and (on Pro) a semantic pass for prompt-injection phrasing aimed at the model instead of the human reader. Pass either a URL to fetch, or raw text you already have.
- **scan_extension** — Check a VS Code extension or a Claude Skill before installing or trusting it. For a VS Code extension (which runs with full Node.js access and no permission model to scope): publisher domain-verification status weighed against install count, and known-bad-signature checks on its description. For a Claude Skill: hidden-instruction and obfuscated-payload detection on the SKILL.md body (the same engine scan_content uses), unscoped or credential-referencing tool grants in its allowed-tools/disallowed-tools frontmatter, inline shell execution baked into the file itself, and pattern matching on any bundled script files for credential-exfiltration signatures. Semantic prompt-injection detection on a skill's body runs too on Pro.
- **check_output** — Check a structured output you're about to return or act on for degenerate-answer patterns a schema check can't see: invalid JSON, a placeholder value ('TBD', 'N/A', 'unknown') where a real answer should be, an array of byte-identical items (a common symptom of a loop that never advanced), or an expected field that's missing or empty. Schema validity and answer quality are different guarantees, call this before trusting your own output, not just after validating it parses.

## Claude Desktop Quick Installation
Remote MCP endpoint (confidence: high). Install path detected from listing signals. Add as a URL/SSE server in your client:

```json
"mcpServers": {
  "preflight-all-the-possibles": {
    "url": "https://preflight.allthepossibles.com/mcp"
  }
}
```

## Documentation

## What Preflight (All the Possibles) does

Preflight (All the Possibles) provides security checks for systems and content that an AI agent may connect to, read, install, or trust. It focuses on risk signals that ordinary schema validation or a basic install review can miss, including unauthenticated MCP transports, overly broad capabilities, hidden instructions, obfuscated payloads, and suspicious output patterns.

The service exposes four MCP tools. `scan_mcp_server` evaluates a reachable server URL or accepts a manifest containing tool definitions when the target cannot be accessed over HTTP. `scan_content` examines either a fetched URL or text supplied directly. `scan_extension` covers VS Code extensions and Claude Skills. `check_output` reviews structured data before an agent returns it or acts on it.

## How it works

The remote MCP endpoint is available at `https://preflight.allthepossibles.com/mcp` over Streamable HTTP. A client can connect to that endpoint and invoke the scanning tools through MCP. A separate REST API is also available for applications that do not use MCP.

Server checks look for transport authentication gaps, capabilities that expose filesystem, shell, or credential access without scoping, and known-bad signatures. Content checks identify invisible Unicode and obfuscated payloads. On the Pro tier, semantic analysis also looks for prompt-injection language directed at the model rather than the human reader.

Extension analysis differs by artifact type. For VS Code extensions, the service considers publisher domain verification alongside install count and checks descriptions for known-bad signatures. Claude Skill checks inspect the `SKILL.md` body, tool-grant frontmatter, inline shell execution, and bundled scripts for credential-exfiltration patterns. Pro analysis adds semantic prompt-injection detection for the skill body.

Output checks cover invalid JSON, placeholder values such as `TBD`, `N/A`, or `unknown` where a substantive answer is expected, repeated byte-identical array items, and missing or empty expected fields.

## Setup and configuration

Connect an MCP-compatible client to `https://preflight.allthepossibles.com/mcp` using Streamable HTTP. The service offers a free tier without signup. Pro semantic scanning is enabled when a Pro API key is supplied as an `Authorization: Bearer` header. For `scan_mcp_server`, provide either a live server URL or a tool manifest; for `scan_content`, provide a URL or raw text.

## Tools and capabilities

- `scan_mcp_server`: Review MCP transport authentication, capability scope, and known-bad signatures.
- `scan_content`: Detect invisible Unicode, obfuscation, and Pro semantic prompt-injection signals in text or fetched pages.
- `scan_extension`: Assess VS Code extensions and Claude Skills, including skill instructions, grants, shell commands, and bundled scripts.
- `check_output`: Find malformed or suspicious structured output before it is trusted.

## Limitations and notes

Semantic prompt-injection analysis requires the Pro tier and a Pro API key. A server that is not reachable over HTTP must be represented with a manifest for `scan_mcp_server`. `check_output` complements schema validation; valid structure alone does not establish that the answer is meaningful or safe to use.

_Full upstream README: https://allmcps.com/mcp/preflight-all-the-possibles/readme_