Passed 21 of 22 test cases with the skill, and 9 of 22 without it.
Without skill41%
With skill95%
Checks it passed that the model alone missed
Identifies this as a C-02 permission overreach finding.
Explains the four probe categories C-01 through C-04 evaluated in the report.
States that an adversarial-input crash in category C-04 caps or assigns Grade D.
and 12 more in the full report
12 fixed9 passed either way1 still failing0 broke
Pass-rate lift
+55 pp
Tokens
+127%
Agent turns
0%
Response time
-43%
Model gemini-3.6-flashMeasured 8/15/2026v121 of 22 cases passed with skill
Tokens, turns and time describe resource use, not a dollar price.
See it in action
One of 12 test cases the skill fixed. Same model, same prompt, with and without the skill.
1 of 12
Prompt
During testing of a third-party tool package, static analysis detected invisible unicode injection instructions in a tool description. What grade is assigned to this package?
What was checked, without and with the skill
Checked
Without skill
With skill
States that active tool-output injection under C-01 causes a Grade F assignment.
Missed
Passed
case-07 · gemini-3.6-flash · 8/15/2026 · answers are capped and redacted
What's inside
The instructions your model reads when the skill loads.
SKILL.md237 lines5 files
Polygraph: Behavioral Trust Grades for MCP Servers
Agents wire up third-party MCP servers and then trust whatever those servers' tools
return. Polygraph tests an MCP server's behavior before your agent does, and assigns a
letter grade A–F backed by reproducible evidence.
A passing grade is a measurement, not a guarantee — it says "this exact tool surface
did not misbehave under these probes," and because the harness is open and deterministic,
anyone can re-run it and disprove a bad grade. That falsifiability is the whole point.
Polygraph connects to a server the way an agent would — stdio for local packages,
Streamable HTTP for remote URLs — fingerprints its exact tool surface
(tools/list → canonical JSON → sha256 → bytes32), then runs four probe categories:
C-01 — Tool-output injection. Does the server try to hijack the agent? Static scan of
tool names/descriptions/schemas for injection-shaped content (invisible unicode,
instruction mimicry, markdown tricks) plus dynamic bait calls that check whether tool
outputs smuggle in instructions.
C-02 — Permission / egress overreach. Does the server do more than it claims? Flags
tools that declare readOnlyHint: true but carry destructive verbs, and runs the server in
a hardened default-deny Docker sandbox where any outbound network attempt is a finding.
C-03 — Sensitive-data handling. Does the server leak secrets? Plants canary values in
the environment and working directory, exercises the tools, and scans both tool outputs and
egress for any canary that surfaces.
C-04 — Adversarial-input handling. Does the server stay robust under hostile input? Runs
two probes on non-state-changing tools, with no Docker required: stress-tests each tool with
malformed and oversized inputs (fails if the server crashes, hangs, or leaks an uncaught
stack trace — a clean validation error or benign result passes); and feeds jailbreak-pattern
strings and scans the server's outputs with the C-01 injection scanners, failing only if
the server emits injection-shaped content it did not merely reflect from the input (a verbatim
echo is excluded). A C-04 failure caps the overall grade at D.