Workflows / Developers and security

Add ZamboDownload the recipe

Review an MCP server before connecting it

A team wants to inspect a server's public tool descriptions, repository, and reliability signals before deciding whether to connect it.

What this is

These checks surface evidence to review. They do not replace a security review, authorization controls, or a test in an isolated environment.

The workflow

  1. 01

    Scan the exact tool description text for suspicious instructions.

    Zambo tool: prompt_shield

    Pattern findings for the text supplied.

  2. 02

    Audit the server's public repository if one is available.

    Zambo tool: provibe_audit

    Use only when: Only if the user supplies a public GitHub repository URL.

    Repository signals and findings within the audit scope.

  3. 03

    Read available reliability results for the exact tool name.

    Zambo tool: reliability_score

    Published pass-rate and latency data when present; absence is not proof of failure.

  4. 04

    Close the review session to group its receipts.

    Zambo tool: workflow_close

    A record of the checks made.

Run it now

Copy this prompt into your AI

First add Zambo to a supported MCP client. The prompt asks for missing inputs and pauses before consequential actions.

Help me review an MCP server before connecting it. Ask for the tool descriptions, the public repo URL if any, and the exact tool name. Scan the supplied descriptions with prompt_shield, audit only the supplied public repo, and read reliability_score for that tool. Explain coverage gaps and do not equate a clean scan with safety. Do not connect to the server, run its tools, or expose credentials. Close this Zambo session only after I review the checks.

Use only the listed Zambo tools and their current live schemas. Ask for any missing input instead of guessing. Stop and ask before any side effect, public sharing, spending, or outside action. Keep all calls for this workflow in one job session when possible. After each call, report the actual result and receipt. If a call fails, do not claim it succeeded; explain how to resume from the last confirmed step.

This is an illustrative recipe, not a measured run. It has not been executed in a connected AI client. Check each returned result; tool limits and schemas can change.

Download the recipe

Versioned JSON lists the exact tool names, input mapping, permissions, expected results, and stop/resume guidance.

Download mcp-server-safety-check.v1.json

What you get

Each listed tool returns its own observed result. workflow_close can group Zambo receipts recorded in the same job session.

A receipt lets someone check the saved call record. It does not establish that an answer was correct, a participant personally did the work, or an outside action happened unless separate evidence supports that.

What it costs

  • Free access: 20 metered calls per UTC day, shared across tools, plus one free wrap-up handover each day.
  • Day Pass: $0.99 for 24 hours, one payment.
  • Zambo Pass: $29 for 30 days, one payment.
  • Lifetime: $250 one payment while Zambo operates. It includes current Level 2 features, not future features or third-party provider costs.
  • No subscription or automatic renewal. A pass does not pay for third-party AI plans or external services.

Some tools have their own free limits or exemptions; check the live tool contract. Use only the calls the job needs. A large set of distinct sources, tasks, or checks can naturally exceed the shared free allowance. These examples have not been measured, so no call total is promised. Never add filler calls to trigger an upgrade.

See one-time pass options

Questions buyers ask

What does this cost?

Free access: 20 metered calls per UTC day, shared across tools, plus one free wrap-up handover each day. Day Pass: $0.99 for 24 hours, one payment. Zambo Pass: $29 for 30 days, one payment. Lifetime: $250 one payment while Zambo operates. It includes current Level 2 features, not future features or third-party provider costs. No subscription or automatic renewal. A pass does not pay for third-party AI plans or external services. A long run may need more than one day; call use varies. See current pricing.

Does my client pay to check the workflow?

No. Opening and checking a public receipt is free at /verify/.

What does a receipt prove?

It lets someone check the saved call record. It does not prove the answer was correct or an outside event happened.

Which AI apps work with this?

Use an MCP client shown on /add/. This starter prompt is client-neutral and has not been run in a connected AI app.

Do I need to code?

No. Add Zambo to a supported MCP client and paste the starter prompt. This workflow may still need the inputs listed above.

What happens when free calls run out?

The shared free allowance is 20 metered calls per UTC day, plus one free wrap-up handover each day. You can stop and continue later, or choose a one-time pass; no pass guarantees a complex run will finish in its access window.

Is this a subscription?

No. Each listed pass is a one-time payment with a stated access period; there is no automatic renewal.

Can I get a refund?

See the refund policy.

Related guides

Ready to try it?

Add Zambo, paste the starter prompt, and provide the real inputs when asked.

Add ZamboDownload recipe

Tool schemas and availability can change. Check the live MCP catalog before running an agent workflow. No calls in this guide have been counted as completed work.