mcp_doctor_checkup · Scan Your Ai Toolkit MCP: Risk & Policy

WHAT IT DOES

What mcp_doctor_checkup does on Scan Your Ai Toolkit

AI agents invoke mcp_doctor_checkup to trigger actions in Scan Your Ai Toolkit. What it does depends on the arguments the agent supplies, and its effects often reach beyond the immediate call — builds kicked off, notifications sent, workflows started.

WHY IT NEEDS A POLICY

Why mcp_doctor_checkup needs a policy

This tool executes diagnostic operations that probe the state of external systems (MCP servers) by validating paths, checking connectivity, and reading environment variables. While non-destructive and read-focused in intent, the act of performing systematic health checks and validation routines constitutes execution of diagnostic logic.

From the tool's definition Tool performs 'full health check on all configured MCP servers' involving validation, connectivity checks, and environment variable inspection. These are diagnostic operations that execute checks and inspection routines across system components.

Attacks that exploit this kind of access

Recommended rule Ready

Verdict

mcp_doctor_checkup Rate-limited

mcp_doctor_checkup stays usable, but rate-capped — a runaway agent can't fire it dozens of times a minute. Everything else on the server is denied unless you say otherwise.

View as policy code

policy.json

{
  "version": "1",
  "default": "deny",
  "tools": {
    "mcp_doctor_checkup": {
      "limits": [
        {
          "counter": "mcp_doctor_checkup_rate",
          "window": "minute",
          "max": 10,
          "scope": "grant"
        }
      ]
    }
  }
}

RATE-LIMIT THIS TOOL →

Instant setup, no code required.

PolicyLayer is an MCP gateway: every tool call is checked against your rule before it reaches Scan Your Ai Toolkit, so you can run agents against it safely.

FAQ

Questions about mcp_doctor_checkup

What does the mcp_doctor_checkup tool do? +

Run a full health check on all configured MCP servers: validates binary paths, checks connectivity, reports missing env vars, and identifies version mismatches. It is categorised as a Execute tool in the Scan Your Ai Toolkit MCP Server, which means it can trigger actions or run processes. Use rate limits and argument validation.

How do I enforce a policy on mcp_doctor_checkup? +

Register the Scan Your Ai Toolkit MCP server in PolicyLayer and add a rule for mcp_doctor_checkup: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches Scan Your Ai Toolkit. Nothing to install.

What risk level is mcp_doctor_checkup? +

mcp_doctor_checkup is a Execute tool with high risk. Execute tools should be rate-limited and have argument validation enabled.

Can I rate-limit mcp_doctor_checkup? +

Yes. Add a rate_limit block to the mcp_doctor_checkup rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.

How do I block mcp_doctor_checkup completely? +

Set action: deny in the PolicyLayer policy for mcp_doctor_checkup. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.

What MCP server provides mcp_doctor_checkup? +

mcp_doctor_checkup is provided by the Scan Your Ai Toolkit MCP server (sakthivelchan89/scan_your_ai_toolkit). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.