Deep inspection

--inspect asks running MCP servers what tools they actually have, instead of inferring from their names.

gate scan --inspect

What it does

For each configured remote server (http or sse), Gate opens a client connection and calls:

• tools/list
• resources/list
• prompts/list

Discovered tools replace the statically-inferred ones. They are then classified into the same capability model and subject to the same rules, including GATE016, which can only fire on inspected tools, since it compares a tool's description against what it does.

Everything a server returns is untrusted, attacker-influenceable text. Tool names and descriptions are sanitised on arrival, before they can reach a terminal, a JSON file or a rule.

Why stdio is different

Gate does not launch local stdio MCP servers, even with --inspect.

Starting one means taking a command line out of a configuration file Gate was asked to audit and executing it. If that file is hostile, the command runs as you, and Gate cannot currently sandbox it. There is no seccomp profile, no Job Object and no container in this release.

So the capability is disabled in this release:

GATE005  db
         local stdio server not started (Gate does not execute commands from
         a config it is auditing; pass --allow-stdio-launch to override)

This costs Gate accuracy on local servers. It is the right trade: security scanner safety takes precedence over feature completeness.

The escape hatch

If you wrote the configuration and you trust it:

gate scan --inspect --allow-stdio-launch

Gate prints the exact command and asks before each server:

About to execute a command from scanned configuration.

  server:  db
  source:  .mcp.json
  command: npx -y mcp-postgres-server

Gate normally refuses to do this. Starting a local MCP server means running
a command line out of the very file Gate is auditing, and Gate cannot
sandbox it. Only continue if you wrote this configuration and trust it.

Start this server? [y/N]

--yes skips the prompt. Do not combine --allow-stdio-launch --yes with a repository you did not write.

Using it in CI

Do not. --inspect in CI means either connecting to production MCP servers from a build runner, or executing untrusted commands on it, usually both.

Static scanning is the CI mode. Deep inspection is a local tool for understanding a server you are evaluating.