Show HN: Diplomat-agent scan Python MCP servers for unguarded tool calls

Description and use

**Brief Summary (2‑3 sentences)**
Diplomat‑agent is an open‑source scanner that crawls Python MCP (Model Context Protocol) servers to detect unguarded tool‑call endpoints, enabling AI assistants to invoke real‑world tools and data through a standardized protocol. By surfacing these insecure or undocumented entry points, the project helps developers quickly prototype safe integrations and build robust MCP‑based back‑ends.

**Value**

• **Bridges the gap** between large‑language‑model assistants and concrete services by automatically locating the tool‑call interfaces they need to interact with.
• **Standardizes** the discovery process for MCP servers, making it easier to ship and consume Model Context Protocol services across teams and organizations.
• **Security‑aware**: highlights unprotected endpoints so developers can harden them before exposing the service to production AI agents.

**Practical Adoption Path**

1. **Clone & Install** – pull the repository, install its Python dependencies (e.g., pip install -r requirements.txt).
2. **Run a Scan** – point the scanner at your MCP server (or a list of servers) using the CLI or a small wrapper script.
3. **Review Findings** – manually inspect the reported unguarded tool calls; decide which should be secured, wrapped, or exposed via proper authentication.
4. **Integrate** – once endpoints are vetted, register them in your AI‑assistant orchestration layer (e.g., LangChain, AutoGPT) using the MCP specifications.
5. **Iterate** – re‑run the scanner after changes to ensure no new unguarded calls are introduced.

**Production Readiness**
The project is at a **medium** readiness level: it is functional and recently updated (2026‑06‑25), making it suitable for prototypes, internal tooling, or as a part of a CI/CD security gate. However, the metadata signals are sparse, so before deploying to production you should:

• Verify the license and confirm it aligns with your organization’s policies.
• Check the issue tracker and release cadence for active maintenance.
• Add automated tests or CI steps that run the scanner on every new MCP deployment.
• Harden any discovered endpoints (authentication, rate limiting, logging) before exposing them to external AI agents.

With these safeguards in place, Diplomat‑agent can become a reliable component of a production‑grade AI‑assistant ecosystem.

Use in a workflow

Show HN: Diplomat-agent scan Python MCP servers for unguarded tool calls helps connect AI assistants to real tools and data through a standard protocol.

• connect AI agents to tools
• ship Model Context Protocol servers
• standardize integrations

Limitations and review notes

Medium: useful for prototypes or internal workflows, with dependency and maintenance checks before production.