Tool Fuzz: argument fuzzing for MCP servers, built on the ToFu method
CLI and GitHub Action that attacks MCP tools with model-written arguments; server authors pay for private repos.
Crowded · ToFu automates tool trust-boundary checks
Written for: Solo builder
Next step
Read the ToFu paper this week and implement just the path-traversal and SSRF checks for TypeScript MCP servers. Run them against the 50 most-starred MCP servers on GitHub, file private disclosures, and post aggregate results on r/mcp and Hacker News.
Why now
MCP servers are multiplying fast enough that proxies like Delta MCP now sit between apps and servers. APEX-Harm shows injected instructions can sit anywhere in a large workspace, so any tool argument can be attacker-controlled. Today's scanners mostly check tool descriptions for poisoning, not what happens when a file-path or URL argument hits the filesystem, shell or network. Nobody owns argument fuzzing as a developer habit yet.
What became possible
ToFu derives semantic security checks for LLM tools from their existing code. It then fuzzes the point where orchestrators wrongly treat model-generated arguments as trusted. That turns a manual pen-test into something a CI job can run.
Two ways in
- toolfuzz CLI
Point it at a TypeScript or Python MCP server. It reads tool schemas and handler code, derives checks (path traversal, SSRF, shell and SQL injection, scope escape), generates adversarial arguments and reports reproducible failures.
- Customer
- Authors of open-source MCP servers on GitHub
- Model
- Free for public repos; $19/month per private repo via the GitHub Action
- Fuzzed badge and public scoreboard
Run toolfuzz across the most-starred MCP servers every week and publish pass/fail. Authors get a README badge once they fix the issues.
- Customer
- MCP server authors and the developers choosing between servers
- Model
- Marketing for the paid tier; later, paid listing verification for registries
Competition
Even then, the pay-for-private-repos model is weak. The target customers are mostly unpaid open-source authors, Snyk and Cisco give comparable scanning away, and the badge idea has no moat because three projects already offer badges. A more realistic buyer is a company that runs internal MCP servers or an MCP registry that wants vetting, not individual authors.
Full competition notes (15 competitors)
This space is crowded. There are at least five open-source MCP fuzzers or dynamic scanners (mcp-fuzzer, mcplint, mcpsec, mcpfuzz, jakk), and at least one, MCPFang, already uses LLM agents to write attack inputs. Several, including jakk, mcpwn and skill-audit-mcp, ship CI or GitHub Action integration with SARIF output. Public badges and leaderboards also exist already, from MCPWatch, mcpscore and Sentinel, and PointGuard AI has graded tens of thousands of servers. The name is a problem as well: the ETH ToolFuzz paper is probably the ToFu method this product builds on, so calling it "toolfuzz" invites confusion. The remaining gap is narrower than the pitch suggests. Most existing tools are either black-box, firing fixed payloads at a live endpoint, or static, scanning configs and descriptions. Few appear to read the handler source code, derive checks specific to each handler (for example, that this tool's path argument must stay inside a given root, or that this URL argument must not reach internal networks), and then generate model-written arguments aimed at those exact code paths. Fewer still prove the issue with a minimal, reproducible failing test that can be dropped into the author's test suite. If toolfuzz can show much higher recall with near-zero false positives on real servers, with published benchmarks against jakk, mcpsec and MCPFang, it could win on quality. Even then, the pay-for-private-repos model is weak. The target customers are mostly unpaid open-source authors, Snyk and Cisco give comparable scanning away, and the badge idea has no moat because three projects already offer badges. A more realistic buyer is a company that runs internal MCP servers or an MCP registry that wants vetting, not individual authors.
- ToolFuzz (ETH Zurich / Vechev group paper, arXiv 2503.04479)
An academic method for fuzzing agent tools with LLM-generated inputs. It looks like the 'ToFu' method this product is based on, and the name 'ToolFuzz' is already taken by it. The paper tests LangChain tools and their documentation, not MCP servers specifically.
- MCP Server Fuzzer (mcp-fuzzer)
A Python fuzzer for MCP tool arguments and protocol messages. It works over stdio, SSE and HTTP, reports crashes, hangs and auth bypasses with a repro for each crash, and has sandboxing.
- mcplint
A Rust MCP testing platform that combines coverage-guided fuzzing with protocol validation, security scanning and tool fingerprinting.
- Mcpsec
Described as an AI-driven dynamic protocol fuzzer. It has dedicated path traversal and SSRF scanners and can optionally use an LLM for reachability analysis.
- MCPFang
Uses LLM adversarial agents that run multi-step attack chains against MCP server tools. This is the closest match to model-written attack arguments.
- jakk
A black-box scanner that sends adversarial probes to live MCP tools, covering command injection, path traversal and SSRF. It outputs SARIF for GitHub Code Scanning. It is deliberately deterministic and uses no LLM.
- mcpfuzz
A dynamic scanner that sends exploit payloads to live MCP servers.
- mcpwn
Scans for SSRF, resource path traversal, tool poisoning and data exfiltration. It includes a CI example that fails the build based on severity.
- Snyk Agent Scan (formerly Invariant mcp-scan)
A scanner from a large vendor (Snyk bought Invariant Labs) that covers tool poisoning, prompt injection and rug pulls. It is mostly about descriptions and config, not argument fuzzing.
- Cisco mcp-scanner
An Apache-2.0 multi-engine MCP scanner from Cisco that uses static analysis and YARA rules.
- MCPWatch
Grades MCP servers A to F against the OWASP MCP Top 10. It has a GitHub Action, a public leaderboard and live SVG badges, which directly overlaps the badge-and-scoreboard idea.
- mcpscore
Calls itself a 'Lighthouse for MCP'. It scores conformance, tool quality and security, and gives each audited server a badge URL.
- Sentinel registry
A public scorecard of 28 popular MCP servers, each graded at a pinned commit, with embeddable badges and findings linked to specific lines of code.
- PointGuard AI MCP study
A commercial vendor that graded more than 36,500 GitHub-hosted MCP servers, so public scoring at scale already exists.
- skill-audit-mcp
A static scanner for MCP servers with a GitHub Action and SARIF output for Code Scanning.
Checked 2026-10-12
Risks
- Snyk (which bought Invariant) or GitHub CodeQL add MCP-specific rules
- The paper's method may not generalise beyond its test tools, and false positives will annoy maintainers
- Disclosure etiquette matters, because public scoreboards of unfixed bugs can backfire
Strong team fit; tech readiness and market pull and open space are the weak point (6).
tech 6 · pull 6 · space 6 · fit 9 · build 7
Exposed
Companies that could benefit or be threatened. News and context, not investment advice.
Momentum of its main topic
Sources
What happened next
- +7d · 19 Oct 2026 nothing yet. No launches, funding announcements, acquisitions, or significant press coverage about MCP server fuzzing tools or argument fuzzing services were found after October 12, 2026. Existing competitors like mcpsec, mcplint, and MCP Server Fuzzer remain unchanged from earlier in 2026, and no new products in this space have been announced during this seven-day window.
Status history
- 2026-10-12 Flagged as buildable