diff --git a/cmd/mcpproxy/security_cmd.go b/cmd/mcpproxy/security_cmd.go
index 688f2d392..87994062c 100644
--- a/cmd/mcpproxy/security_cmd.go
+++ b/cmd/mcpproxy/security_cmd.go
@@ -41,8 +41,15 @@ func GetSecurityCommand() *cobra.Command {
 		Long: `Commands for managing security scanners, scanning MCP servers,
 and reviewing scan results.
 
-Security scanners run as Docker containers and analyze upstream MCP servers
-for vulnerabilities, tool poisoning attacks, and other security issues.
+Scanning works out of the box: the offline baseline scanner is built into
+mcpproxy, runs in-process on every scan, and needs no Docker and no setup. It
+analyzes tool descriptions and schemas for tool poisoning attacks (TPAs),
+prompt injection, and data exfiltration.
+
+Deep scanners are the optional extra layer. They run as Docker containers for
+source and dependency analysis (CVEs, secrets), so they need Docker plus
+"deep scan" enabled — and when they are unavailable they are skipped, never
+blocking the baseline verdict.
 
 Examples:
   mcpproxy security scanners
diff --git a/docs/features/security-quarantine.md b/docs/features/security-quarantine.md
index 4410d20bb..3f29420dc 100644
--- a/docs/features/security-quarantine.md
+++ b/docs/features/security-quarantine.md
@@ -172,6 +172,28 @@ Manage held prompts with the `quarantine_security` MCP tool:
 
 ## Managing Quarantine
 
+### Scan a Server for TPAs (MCP)
+
+The `quarantine_security` tool can also run and read the TPA scan, so an agent
+reviewing a held server does not have to leave for the CLI or web UI:
+
+```jsonc
+// run the offline baseline scan (in-process, no Docker required)
+{ "operation": "scan_server", "name": "github" }
+// read the latest verdict + findings
+{ "operation": "get_scan_report", "name": "github" }
+```
+
+`scan_server` answers with the verdict when the scan settles quickly, otherwise
+with the job id and `"status": "scan started"` — poll `get_scan_report` for the
+result. Every `list_quarantined`, `inspect_quarantined` and `inspect_tools`
+response also carries a one-line `scan_status`, so a server nobody ever scanned
+reads as `never scanned — run scan_server first` instead of looking clean.
+
+The optional Docker-based deep scanners are a separate layer: they run only when
+[deep scan](/features/security-scanner-plugins) is enabled, and when they are
+unavailable they are skipped without changing the baseline verdict.
+
 ### View Quarantined Servers
 
 **Web UI:**
diff --git a/frontend/src/views/Security.vue b/frontend/src/views/Security.vue
index c289a6862..6467f6a03 100644
--- a/frontend/src/views/Security.vue
+++ b/frontend/src/views/Security.vue
@@ -7,12 +7,16 @@
         <p class="text-base-content/70 mt-1">Configure security scanner plugins and review scan results</p>
       </div>
       <div class="flex gap-2">
-        <div
-          v-if="(overview?.scanners_enabled ?? overview?.scanners_installed ?? 0) > 0"
-          class="tooltip"
-          :data-tip="!overview?.docker_available ? 'Docker is required to run security scanners' : ''"
-        >
-          <button @click="startScanAll" :disabled="loading || scanAllRunning || !overview?.docker_available" class="btn btn-primary">
+        <!-- The offline baseline scanner is built in and always runs, so this
+             action is never gated on Docker or on an installed deep scanner
+             (mirrors the per-server Scan Now button, spec 088 FR-016). -->
+        <div class="tooltip" :data-tip="scanAllTooltip(overview?.docker_available)">
+          <button
+            @click="startScanAll"
+            :disabled="loading || scanAllRunning"
+            class="btn btn-primary"
+            data-test="scan-all-button"
+          >
             <span v-if="scanAllRunning" class="loading loading-spinner loading-sm"></span>
             {{ scanAllRunning ? 'Scanning...' : 'Scan All Servers' }}
           </button>
@@ -151,12 +155,13 @@
       </div>
     </div>
 
-    <!-- Docker unavailable warning (only after overview has loaded) -->
-    <div v-if="overviewLoaded && overview.docker_available === false" class="alert alert-warning">
+    <!-- Docker unavailable warning (only after overview has loaded). Scanning
+         still works: only the optional deep scanners need Docker. -->
+    <div v-if="overviewLoaded && overview.docker_available === false" class="alert alert-warning" data-test="docker-unavailable-alert">
       <svg class="w-5 h-5 shrink-0" fill="none" stroke="currentColor" viewBox="0 0 24 24">
         <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M12 9v2m0 4h.01m-6.938 4h13.856c1.54 0 2.502-1.667 1.732-2.5L13.732 4c-.77-.833-1.964-.833-2.732 0L4.082 16.5c-.77.833.192 2.5 1.732 2.5z" />
       </svg>
-      <span>Docker is not running. Security scanners require Docker to analyze MCP servers.</span>
+      <span>Docker is not running, so the optional deep scanners are skipped. The built-in offline baseline scan still runs.</span>
     </div>
 
     <!-- Docker isolation nudge: show only when Docker is available, global
@@ -513,7 +518,7 @@ import { refreshSecurityScannerStatus } from '@/composables/useSecurityScannerSt
 import { useSystemStore } from '@/stores/system'
 import { scanReportPath } from '@/utils/serverRoute'
 import { formatSignatureBundle } from '@/utils/signatureBundle'
-import { deepScanSummary, enabledDockerScanners, scannerWontRun } from './security/deepScanState'
+import { deepScanSummary, enabledDockerScanners, scanAllTooltip, scannerWontRun } from './security/deepScanState'
 
 const systemStore = useSystemStore()
 
diff --git a/frontend/src/views/security/deepScanState.ts b/frontend/src/views/security/deepScanState.ts
index ef05cb595..152340c05 100644
--- a/frontend/src/views/security/deepScanState.ts
+++ b/frontend/src/views/security/deepScanState.ts
@@ -47,6 +47,23 @@ export function enabledDockerScanners(scanners: ScannerLike[]): number {
   return scanners.filter(s => isDockerScanner(s) && isScannerEnabled(String(s.status ?? ''))).length
 }
 
+/**
+ * Tooltip for the page-level "Scan All Servers" action.
+ *
+ * Docker is NOT a precondition for scanning: the offline baseline scanner is
+ * built into mcpproxy and runs in-process for every server. Only the optional
+ * deep scanners need Docker. The old copy ("Docker is required to run security
+ * scanners") came with a hard `disabled` on the button, which left a default
+ * install — no Docker, no installed scanner — with no way to scan at all, the
+ * same bug already fixed for the per-server Scan Now button (spec 088 FR-016).
+ */
+export function scanAllTooltip(dockerAvailable: boolean | null | undefined): string {
+  if (dockerAvailable === false) {
+    return 'Optional deep scanners need Docker; the offline baseline scan is built in'
+  }
+  return 'Runs the built-in offline baseline scan on every server'
+}
+
 /**
  * The master card's one-line status. Names what a scan will do right now,
  * from the operator's side of the screen.
diff --git a/frontend/tests/unit/security-scan-all-ungate.spec.ts b/frontend/tests/unit/security-scan-all-ungate.spec.ts
new file mode 100644
index 000000000..1b8fa787f
--- /dev/null
+++ b/frontend/tests/unit/security-scan-all-ungate.spec.ts
@@ -0,0 +1,109 @@
+import { describe, it, expect, beforeEach, vi } from 'vitest'
+import { mount, flushPromises } from '@vue/test-utils'
+import { createPinia, setActivePinia } from 'pinia'
+import { createRouter, createWebHistory } from 'vue-router'
+import { scanAllTooltip } from '@/views/security/deepScanState'
+
+// "Scan All Servers" was unreachable on exactly the installs that had never
+// scanned anything: it only rendered when the overview reported an installed
+// scanner (the always-on in-process baseline was not counted, so a fresh
+// install reported zero), and it was disabled without Docker — the same false
+// gate already fixed for the per-server Scan Now button (spec 088 FR-016).
+//
+// Every fixture here is that default install: zero scanners, no Docker.
+
+let overviewPayload: Record<string, unknown>
+
+vi.mock('@/services/api', () => {
+  const ok = (data: unknown = {}) => Promise.resolve({ success: true, data })
+  return {
+    default: {
+      getSecurityOverview: vi.fn(() => ok(overviewPayload)),
+      listScanners: vi.fn(() => ok([])),
+      listScanHistory: vi.fn(() => ok({ scans: [], total: 0 })),
+      getQueueProgress: vi.fn(() => ok({ status: 'idle' })),
+      getConfig: vi.fn(() => ok({ docker_isolation: { enabled: false }, security: { deep_scan: { enabled: false } } })),
+      getServers: vi.fn(() => ok({ servers: [] })),
+      scanAll: vi.fn(() => ok({ status: 'running', total: 1, completed: 0, running: 1 })),
+      installScanner: vi.fn(() => ok({})),
+      removeScanner: vi.fn(() => ok({})),
+      configureScanner: vi.fn(() => ok({})),
+      cancelAllScans: vi.fn(() => ok({})),
+      patchConfig: vi.fn(() => ok({})),
+      updateConfig: vi.fn(() => ok({})),
+    },
+  }
+})
+
+async function mountSecurity() {
+  const api = (await import('@/services/api')).default
+  const Security = (await import('@/views/Security.vue')).default
+  const router = createRouter({
+    history: createWebHistory(),
+    routes: [
+      { path: '/', component: { template: '<div/>' } },
+      { path: '/settings', component: { template: '<div/>' } },
+      { path: '/security/scans/:jobId', component: { template: '<div/>' } },
+    ],
+  })
+  await router.push('/')
+  await router.isReady()
+  const wrapper = mount(Security, { global: { plugins: [createPinia(), router] } })
+  await flushPromises()
+  await flushPromises()
+  return { wrapper, api }
+}
+
+beforeEach(() => {
+  setActivePinia(createPinia())
+  vi.clearAllMocks()
+  // A fresh install as the backend used to report it: nothing persisted.
+  overviewPayload = { scanners_enabled: 0, scanners_installed: 0, docker_available: false }
+})
+
+describe('Security page — Scan All is reachable on a default install', () => {
+  it('renders the Scan All button with zero reported scanners', async () => {
+    const { wrapper } = await mountSecurity()
+    expect(wrapper.find('[data-test="scan-all-button"]').exists()).toBe(true)
+    wrapper.unmount()
+  })
+
+  it('leaves it enabled when Docker is unavailable', async () => {
+    const { wrapper } = await mountSecurity()
+    expect(wrapper.find('[data-test="scan-all-button"]').attributes('disabled')).toBeUndefined()
+    wrapper.unmount()
+  })
+
+  it('starts a batch scan from the button on a default install', async () => {
+    const { wrapper, api } = await mountSecurity()
+    await wrapper.find('[data-test="scan-all-button"]').trigger('click')
+    await flushPromises()
+    expect(api.scanAll).toHaveBeenCalled()
+    wrapper.unmount()
+  })
+
+  it('explains Docker as a deep-scan-only requirement, not a scanning blocker', async () => {
+    const { wrapper } = await mountSecurity()
+    const tip = wrapper.find('[data-test="scan-all-button"]').element.parentElement?.getAttribute('data-tip') ?? ''
+    expect(tip).toContain('deep scanners need Docker')
+    expect(tip).toContain('baseline')
+    expect(tip).not.toContain('Docker is required')
+
+    const alert = wrapper.find('[data-test="docker-unavailable-alert"]')
+    expect(alert.exists()).toBe(true)
+    expect(alert.text()).toContain('baseline scan still runs')
+    wrapper.unmount()
+  })
+})
+
+describe('scanAllTooltip', () => {
+  it('names deep scanners — not scanning itself — as what Docker gates', () => {
+    expect(scanAllTooltip(false)).toBe('Optional deep scanners need Docker; the offline baseline scan is built in')
+  })
+
+  it('describes the baseline scan when Docker is present or unknown', () => {
+    expect(scanAllTooltip(true)).toContain('offline baseline scan')
+    expect(scanAllTooltip(undefined)).toContain('offline baseline scan')
+    expect(scanAllTooltip(null)).toContain('offline baseline scan')
+  })
+})
diff --git a/internal/security/scanner/overview_baseline_test.go b/internal/security/scanner/overview_baseline_test.go
new file mode 100644
index 000000000..13e46c106
--- /dev/null
+++ b/internal/security/scanner/overview_baseline_test.go
@@ -0,0 +1,113 @@
+package scanner
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.uber.org/zap"
+)
+
+// newFreshInstallService builds a service over the REAL bundled registry and an
+// empty storage — i.e. exactly what a user gets on first launch, before any
+// Docker scanner has ever been installed.
+func newFreshInstallService(t *testing.T) *Service {
+	t.Helper()
+	logger := zap.NewNop()
+	dir := t.TempDir()
+	return NewService(newMockStorage(), NewRegistry(dir, logger), NewDockerRunner(logger), dir, logger)
+}
+
+// TestGetOverview_CountsAlwaysOnBaselineOnFreshInstall pins the fix for the
+// invisible "Scan All Servers" button: the overview counted only scanners
+// persisted in BBolt, so a fresh install reported scanners_enabled=0 even
+// though the in-process tpa-descriptions baseline is always installed and runs
+// on every scan. The web UI hides its scan-trigger button on 0.
+func TestGetOverview_CountsAlwaysOnBaselineOnFreshInstall(t *testing.T) {
+	svc := newFreshInstallService(t)
+
+	overview, err := svc.GetOverview(context.Background())
+	require.NoError(t, err)
+
+	assert.GreaterOrEqual(t, overview.ScannersEnabled, 1,
+		"the always-on in-process baseline must count as enabled on a fresh install")
+	assert.GreaterOrEqual(t, overview.ScannersInstalled, overview.ScannersEnabled,
+		"installed is a superset of enabled")
+
+	// The count is the in-process baseline, not the Docker scanners: those load
+	// as "available" and must stay uncounted until their image is pulled.
+	inProcessEnabled := 0
+	for _, sc := range svc.registry.List() {
+		if sc.InProcess && (sc.Status == ScannerStatusInstalled || sc.Status == ScannerStatusConfigured) {
+			inProcessEnabled++
+		}
+	}
+	assert.Equal(t, inProcessEnabled, overview.ScannersEnabled,
+		"only the in-process baseline is enabled before any Docker scanner is installed")
+}
+
+// TestGetOverview_DoesNotDoubleCountPersistedBaseline guards the other half:
+// once the baseline IS persisted (older builds saved it, and the healing path
+// in syncRegistryFromStorage rewrites it), the registry pass must not count it
+// a second time.
+func TestGetOverview_DoesNotDoubleCountPersistedBaseline(t *testing.T) {
+	logger := zap.NewNop()
+	dir := t.TempDir()
+	store := newMockStorage()
+	registry := NewRegistry(dir, logger)
+
+	baseline, err := registry.Get(inProcessTPAScannerID)
+	require.NoError(t, err)
+	persisted := *baseline
+	persisted.Status = ScannerStatusInstalled
+	require.NoError(t, store.SaveScanner(&persisted))
+
+	svc := NewService(store, registry, NewDockerRunner(logger), dir, logger)
+	overview, err := svc.GetOverview(context.Background())
+	require.NoError(t, err)
+
+	assert.Equal(t, 1, overview.ScannersEnabled, "the persisted baseline is counted exactly once")
+	assert.Equal(t, 1, overview.ScannersInstalled, "the persisted baseline is counted exactly once")
+}
+
+// TestGetOverview_ConcurrentScannerStatusUpdateIsRaceFree guards the read seam
+// the baseline count added. Registry.List() hands out the live *ScannerPlugin
+// records the registry keeps, and UpdateStatus mutates Status on exactly those
+// records under the registry lock — so counting by reading reg.Status outside
+// the lock is a data race with any concurrent install/pull. GetOverview must
+// resolve the predicate inside the registry instead. Run with -race.
+func TestGetOverview_ConcurrentScannerStatusUpdateIsRaceFree(t *testing.T) {
+	svc := newFreshInstallService(t)
+
+	done := make(chan struct{})
+	go func() {
+		defer close(done)
+		for i := 0; i < 200; i++ {
+			status := ScannerStatusInstalled
+			if i%2 == 0 {
+				status = ScannerStatusAvailable
+			}
+			_ = svc.registry.UpdateStatus(inProcessTPAScannerID, status)
+		}
+	}()
+
+	for i := 0; i < 200; i++ {
+		_, err := svc.GetOverview(context.Background())
+		require.NoError(t, err)
+	}
+	<-done
+}
+
+// TestGetOverview_ToleratesNilRegistry pins the nil-registry contract: other
+// Service methods already guard for it, and the overview must not be the one
+// call that panics on a service built without a registry.
+func TestGetOverview_ToleratesNilRegistry(t *testing.T) {
+	logger := zap.NewNop()
+	dir := t.TempDir()
+	svc := NewService(newMockStorage(), nil, NewDockerRunner(logger), dir, logger)
+
+	overview, err := svc.GetOverview(context.Background())
+	require.NoError(t, err)
+	assert.Equal(t, 0, overview.ScannersEnabled)
+}
diff --git a/internal/security/scanner/registry.go b/internal/security/scanner/registry.go
index fcde70523..4fb859b48 100644
--- a/internal/security/scanner/registry.go
+++ b/internal/security/scanner/registry.go
@@ -93,6 +93,34 @@ func (r *Registry) List() []*ScannerPlugin {
 	return result
 }
 
+// InProcessRunnableIDs returns the IDs of in-process scanners whose status
+// means the engine will actually run them (installed or configured), sorted.
+//
+// It exists so a caller can count the always-on in-process baseline without
+// reading ScannerPlugin fields outside the registry lock: List() hands out the
+// live pointers the registry keeps, and UpdateStatus mutates Status on exactly
+// those records, so an unsynchronized read of reg.Status races with any
+// concurrent install/pull. Resolving the predicate here keeps the read under
+// the same lock as the write.
+func (r *Registry) InProcessRunnableIDs() []string {
+	if r == nil {
+		return nil
+	}
+	r.mu.RLock()
+	defer r.mu.RUnlock()
+	ids := make([]string, 0, len(r.scanners))
+	for id, s := range r.scanners {
+		if s == nil || !s.InProcess {
+			continue
+		}
+		if s.Status == ScannerStatusInstalled || s.Status == ScannerStatusConfigured {
+			ids = append(ids, id)
+		}
+	}
+	sort.Strings(ids)
+	return ids
+}
+
 // Get returns a scanner by ID
 func (r *Registry) Get(id string) (*ScannerPlugin, error) {
 	r.mu.RLock()
diff --git a/internal/security/scanner/service.go b/internal/security/scanner/service.go
index e8adf1f0e..16a0c4ea0 100644
--- a/internal/security/scanner/service.go
+++ b/internal/security/scanner/service.go
@@ -145,23 +145,32 @@ type Service struct {
 	// resolver. Nil ⇒ fall back to the engine-wide default.
 	isolationModeResolver func(serverName string) string
 
-	// In-memory scan summary cache — avoids expensive BBolt reads per server
-	summaryCache   map[string]*ScanSummary
-	summaryCacheMu sync.RWMutex
+	// In-memory scan summary cache — avoids expensive BBolt reads per server.
+	//
+	// summaryCacheGen is a per-server invalidation counter. GetScanSummary
+	// computes a summary from BBolt OUTSIDE the cache lock, so a scan that
+	// starts mid-computation would otherwise have its invalidation overwritten
+	// by the in-flight reader storing the pre-scan summary — leaving a stale
+	// "clean" verdict cached for a server whose scan is running. The reader
+	// samples the generation on the cache miss and refuses to store if it moved.
+	summaryCache    map[string]*ScanSummary
+	summaryCacheGen map[string]uint64
+	summaryCacheMu  sync.RWMutex
 }
 
 // NewService creates a new SecurityService
 func NewService(storage Storage, registry *Registry, docker *DockerRunner, dataDir string, logger *zap.Logger) *Service {
 	engine := NewEngine(docker, registry, dataDir, logger)
 	svc := &Service{
-		storage:        storage,
-		engine:         engine,
-		registry:       registry,
-		docker:         docker,
-		sourceResolver: NewSourceResolver(logger),
-		queue:          NewScanQueue(logger),
-		summaryCache:   make(map[string]*ScanSummary),
-		logger:         logger,
+		storage:         storage,
+		engine:          engine,
+		registry:        registry,
+		docker:          docker,
+		sourceResolver:  NewSourceResolver(logger),
+		queue:           NewScanQueue(logger),
+		summaryCache:    make(map[string]*ScanSummary),
+		summaryCacheGen: make(map[string]uint64),
+		logger:          logger,
 	}
 	var noop EventEmitter = &NoopEmitter{}
 	svc.emitter.Store(&noop)
@@ -1850,18 +1859,37 @@ func (s *Service) GetOverview(ctx context.Context) (*SecurityOverview, error) {
 	overview := &SecurityOverview{}
 
 	// Count installed scanners. ScannersInstalled is the total number of
-	// scanners persisted in storage; ScannersEnabled is the subset the engine
-	// will actually run (status installed or configured). UI uses
-	// ScannersEnabled to decide whether to show scan-trigger buttons.
+	// scanners the proxy holds an install record for; ScannersEnabled is the
+	// subset the engine will actually run (status installed or configured). UI
+	// uses ScannersEnabled to decide whether to show scan-trigger buttons.
+	//
+	// Both counts have to include the in-process baseline scanner
+	// (tpa-descriptions), which is always installed+enabled and lives in the
+	// in-memory registry — nothing persists it to BBolt until a Docker scanner
+	// is installed. Counting storage alone reported 0/0 on a fresh install and
+	// hid the web UI's "Scan All Servers" button on exactly the installs that
+	// have never scanned anything.
+	seen := make(map[string]bool)
 	scanners, err := s.storage.ListScanners()
 	if err == nil {
 		overview.ScannersInstalled = len(scanners)
 		for _, sc := range scanners {
+			seen[sc.ID] = true
 			if sc.Status == ScannerStatusInstalled || sc.Status == ScannerStatusConfigured {
 				overview.ScannersEnabled++
 			}
 		}
 	}
+	// InProcessRunnableIDs resolves the predicate under the registry lock:
+	// List() returns the live *ScannerPlugin records that UpdateStatus mutates,
+	// so reading Status out here would race with a concurrent install/pull.
+	for _, id := range s.registry.InProcessRunnableIDs() {
+		if seen[id] {
+			continue
+		}
+		overview.ScannersInstalled++
+		overview.ScannersEnabled++
+	}
 
 	// Count scan jobs
 	jobs, err := s.storage.ListScanJobs("")
@@ -1954,6 +1982,11 @@ func (s *Service) GetScanSummary(ctx context.Context, serverName string) *ScanSu
 		s.summaryCacheMu.RUnlock()
 		return cached
 	}
+	// Sample the invalidation generation in the same critical section as the
+	// miss. Everything below reads BBolt with no lock held, so this is the
+	// token that lets cacheScanSummary tell "still current" from "a scan
+	// started while I was computing".
+	cacheGen := s.summaryCacheGen[serverName]
 	s.summaryCacheMu.RUnlock()
 
 	// Check for active scan (Pass 1 takes priority in status display)
@@ -1975,7 +2008,7 @@ func (s *Service) GetScanSummary(ctx context.Context, serverName string) *ScanSu
 		// Only cache the explicit "no scans found" sentinel — transient
 		// I/O errors must retry on the next call.
 		if errors.Is(err, errNoScans) {
-			s.cacheScanSummary(serverName, nil)
+			s.cacheScanSummary(serverName, nil, cacheGen)
 		}
 		return nil
 	}
@@ -2001,7 +2034,7 @@ func (s *Service) GetScanSummary(ctx context.Context, serverName string) *ScanSu
 	// Check if the primary job failed
 	if primaryJob.Status == ScanJobStatusFailed {
 		summary.Status = "failed"
-		s.cacheScanSummary(serverName, summary)
+		s.cacheScanSummary(serverName, summary, cacheGen)
 		return summary
 	}
 
@@ -2021,7 +2054,7 @@ func (s *Service) GetScanSummary(ctx context.Context, serverName string) *ScanSu
 		}
 		if summary.ScannersRun == 0 {
 			summary.Status = "failed"
-			s.cacheScanSummary(serverName, summary)
+			s.cacheScanSummary(serverName, summary, cacheGen)
 			return summary
 		}
 	}
@@ -2064,7 +2097,7 @@ func (s *Service) GetScanSummary(ctx context.Context, serverName string) *ScanSu
 				summary.Status = "failed"
 			}
 		}
-		s.cacheScanSummary(serverName, summary)
+		s.cacheScanSummary(serverName, summary, cacheGen)
 		return summary
 	}
 
@@ -2081,7 +2114,7 @@ func (s *Service) GetScanSummary(ctx context.Context, serverName string) *ScanSu
 	summary.Status = verdict
 
 	// Cache for fast subsequent reads
-	s.cacheScanSummary(serverName, summary)
+	s.cacheScanSummary(serverName, summary, cacheGen)
 	return summary
 }
 
@@ -2215,10 +2248,14 @@ type FindingCounts struct {
 }
 
 // invalidateScanSummaryCache removes a server's cached scan summary,
-// forcing the next GetScanSummary call to recompute from storage.
+// forcing the next GetScanSummary call to recompute from storage. It also bumps
+// the server's cache generation so any GetScanSummary already mid-flight — it
+// read BBolt before this scan existed — cannot store its now-stale result on
+// top of this invalidation.
 func (s *Service) invalidateScanSummaryCache(serverName string) {
 	s.summaryCacheMu.Lock()
 	delete(s.summaryCache, serverName)
+	s.summaryCacheGen[serverName]++
 	s.summaryCacheMu.Unlock()
 }
 
@@ -2226,10 +2263,21 @@ func (s *Service) invalidateScanSummaryCache(serverName string) {
 // is stored as a sentinel meaning "we already checked, this server has no
 // scans" — used by spec 047 to avoid re-scanning the BBolt scan-job bucket on
 // every poll for untouched servers.
-func (s *Service) cacheScanSummary(serverName string, summary *ScanSummary) {
+//
+// gen is the generation sampled when the caller missed the cache. If the server
+// was invalidated since (a scan started, progressed or finished while this
+// summary was being computed) the result describes a superseded state, so it is
+// dropped rather than published: a resurrected pre-scan summary would report a
+// stale "clean" verdict for a server that is being scanned right now, and
+// quarantine_security's scan_server/get_scan_report hand that verdict straight
+// to an agent.
+func (s *Service) cacheScanSummary(serverName string, summary *ScanSummary, gen uint64) {
 	s.summaryCacheMu.Lock()
+	defer s.summaryCacheMu.Unlock()
+	if s.summaryCacheGen[serverName] != gen {
+		return
+	}
 	s.summaryCache[serverName] = summary
-	s.summaryCacheMu.Unlock()
 }
 
 // waitForConnection polls IsConnected until the server connects or the timeout expires.
diff --git a/internal/security/scanner/service_test.go b/internal/security/scanner/service_test.go
index 091704617..dc4dd3926 100644
--- a/internal/security/scanner/service_test.go
+++ b/internal/security/scanner/service_test.go
@@ -2131,7 +2131,10 @@ func TestGetScanSummary_OverwritesNilSentinelOnRealScan(t *testing.T) {
 		t.Fatalf("SaveScanJob: %v", err)
 	}
 	real := &ScanSummary{Status: "clean", LastScanAt: &now}
-	svc.cacheScanSummary("later-scanned", real)
+	svc.summaryCacheMu.RLock()
+	realGen := svc.summaryCacheGen["later-scanned"]
+	svc.summaryCacheMu.RUnlock()
+	svc.cacheScanSummary("later-scanned", real, realGen)
 
 	// Subsequent GetScanSummary returns the real summary, not the nil sentinel.
 	if got := svc.GetScanSummary(context.Background(), "later-scanned"); got == nil || got.Status != "clean" {
diff --git a/internal/security/scanner/start_scan_cleanup_test.go b/internal/security/scanner/start_scan_cleanup_test.go
new file mode 100644
index 000000000..de1cd7480
--- /dev/null
+++ b/internal/security/scanner/start_scan_cleanup_test.go
@@ -0,0 +1,76 @@
+package scanner
+
+import (
+	"context"
+	"os"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.uber.org/zap"
+)
+
+// Service.StartScan exports tool definitions into an os.MkdirTemp directory and
+// hands ownership of the cleanup to the scan callback. The engine, however, can
+// reject the scan (another scan already in progress, no scanners resolved)
+// BEFORE it ever invokes that callback — so on the reject path nothing ever
+// removes the directory. It leaks for the life of the process, and
+// quarantine_security's scan_server makes that path agent-reachable in a loop.
+func TestStartScan_CleansUpTempDirWhenEngineRejectsScan(t *testing.T) {
+	// Point os.MkdirTemp("") at a scratch dir. Which variable wins is
+	// platform-specific (TMPDIR on unix, TMP/TEMP on Windows), so set all three
+	// and then read back os.TempDir() rather than asserting any one of them
+	// took effect — and count only OUR prefix, so the assertion is still exact
+	// even if the process temp dir is shared.
+	tmpRoot := t.TempDir()
+	t.Setenv("TMPDIR", tmpRoot)
+	t.Setenv("TMP", tmpRoot)
+	t.Setenv("TEMP", tmpRoot)
+
+	countScanTempDirs := func() int {
+		entries, err := os.ReadDir(os.TempDir())
+		require.NoError(t, err)
+		n := 0
+		for _, e := range entries {
+			if strings.HasPrefix(e.Name(), "mcpproxy-scan-tools-") {
+				n++
+			}
+		}
+		return n
+	}
+
+	dir := t.TempDir()
+	logger := zap.NewNop()
+	svc := NewService(newMockStorage(), NewRegistry(dir, logger), NewDockerRunner(logger), dir, logger)
+	svc.SetServerInfoProvider(&scanSpyProvider{info: &ServerInfo{
+		Name:     "busy-srv",
+		Protocol: "stdio",
+		Command:  "node",
+		Args:     []string{"server.js"},
+	}})
+
+	// Occupy the engine so every StartScan is rejected deterministically —
+	// exactly what a second scan_server call hits while the first still runs.
+	svc.engine.mu.Lock()
+	svc.engine.activeScans["busy-srv"] = &ScanJob{
+		ID:         "scan-busy-srv-preexisting",
+		ServerName: "busy-srv",
+		Status:     ScanJobStatusRunning,
+		ScanPass:   ScanPassSecurityScan,
+		StartedAt:  time.Now(),
+	}
+	svc.engine.mu.Unlock()
+
+	before := countScanTempDirs()
+
+	for i := 0; i < 3; i++ {
+		job, err := svc.StartScan(context.Background(), "busy-srv", false, nil, "")
+		require.Error(t, err, "the engine must reject while a scan is in progress")
+		assert.Nil(t, job)
+	}
+
+	assert.Equal(t, before, countScanTempDirs(),
+		"a rejected scan must not leave its tool-definition temp dir behind")
+}
diff --git a/internal/security/scanner/summary_cache_generation_test.go b/internal/security/scanner/summary_cache_generation_test.go
new file mode 100644
index 000000000..1b12a6d53
--- /dev/null
+++ b/internal/security/scanner/summary_cache_generation_test.go
@@ -0,0 +1,108 @@
+package scanner
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// The scan-summary cache is written by GetScanSummary AFTER it has read BBolt
+// with no lock held, and invalidated by the scan callbacks. Without a
+// generation token the two interleave into a lost invalidation: a reader that
+// sampled the pre-scan state stores it on top of the invalidation a starting
+// scan just performed, and every later reader is served that stale summary from
+// cache. It matters because quarantine_security's scan_server waits for the job
+// to settle and then reports GetScanSummary's verdict verbatim to an agent — a
+// resurrected pre-scan "clean" would be handed over as the new scan's result.
+
+// TestCacheScanSummary_DropsWriteInvalidatedMidComputation is the direct
+// regression: sample a generation, invalidate (as a starting scan does), then
+// try to store. The store must be refused.
+func TestCacheScanSummary_DropsWriteInvalidatedMidComputation(t *testing.T) {
+	svc := newFreshInstallService(t)
+	const server = "victim"
+
+	// A reader misses the cache and samples the generation.
+	svc.summaryCacheMu.RLock()
+	gen := svc.summaryCacheGen[server]
+	svc.summaryCacheMu.RUnlock()
+
+	// While it reads BBolt, a scan starts and invalidates.
+	svc.invalidateScanSummaryCache(server)
+
+	// The in-flight reader now tries to publish its pre-scan summary.
+	stale := &ScanSummary{Status: "clean"}
+	svc.cacheScanSummary(server, stale, gen)
+
+	svc.summaryCacheMu.RLock()
+	cached, ok := svc.summaryCache[server]
+	svc.summaryCacheMu.RUnlock()
+
+	assert.False(t, ok, "a summary computed before the invalidation must not be cached")
+	assert.Nil(t, cached)
+}
+
+// TestCacheScanSummary_StoresWhenGenerationUnchanged pins the other half: the
+// guard must not break ordinary caching, or spec 047's negative caching would
+// stop working and every poll would re-scan the BBolt job bucket.
+func TestCacheScanSummary_StoresWhenGenerationUnchanged(t *testing.T) {
+	svc := newFreshInstallService(t)
+	const server = "quiet"
+
+	svc.summaryCacheMu.RLock()
+	gen := svc.summaryCacheGen[server]
+	svc.summaryCacheMu.RUnlock()
+
+	summary := &ScanSummary{Status: "clean"}
+	svc.cacheScanSummary(server, summary, gen)
+
+	svc.summaryCacheMu.RLock()
+	cached, ok := svc.summaryCache[server]
+	svc.summaryCacheMu.RUnlock()
+
+	require.True(t, ok, "an uncontended summary must still be cached")
+	assert.Same(t, summary, cached)
+
+	// The nil sentinel ("checked, never scanned") must cache too.
+	const empty = "untouched"
+	svc.summaryCacheMu.RLock()
+	emptyGen := svc.summaryCacheGen[empty]
+	svc.summaryCacheMu.RUnlock()
+	svc.cacheScanSummary(empty, nil, emptyGen)
+
+	svc.summaryCacheMu.RLock()
+	sentinel, sentinelOK := svc.summaryCache[empty]
+	svc.summaryCacheMu.RUnlock()
+
+	assert.True(t, sentinelOK, "the negative-cache sentinel must still be stored")
+	assert.Nil(t, sentinel)
+}
+
+// TestInvalidateScanSummaryCache_AdvancesGeneration pins that invalidation is
+// what moves the token — a second invalidation must not reuse the first's
+// generation, or two scans in a row would reopen the window.
+func TestInvalidateScanSummaryCache_AdvancesGeneration(t *testing.T) {
+	svc := newFreshInstallService(t)
+	const server = "twice"
+
+	svc.summaryCacheMu.RLock()
+	start := svc.summaryCacheGen[server]
+	svc.summaryCacheMu.RUnlock()
+
+	svc.invalidateScanSummaryCache(server)
+	svc.invalidateScanSummaryCache(server)
+
+	svc.summaryCacheMu.RLock()
+	end := svc.summaryCacheGen[server]
+	svc.summaryCacheMu.RUnlock()
+
+	assert.Equal(t, start+2, end, "each invalidation must advance the generation")
+
+	// A reader holding the pre-invalidation token is still refused.
+	svc.cacheScanSummary(server, &ScanSummary{Status: "clean"}, start)
+	svc.summaryCacheMu.RLock()
+	_, ok := svc.summaryCache[server]
+	svc.summaryCacheMu.RUnlock()
+	assert.False(t, ok)
+}
diff --git a/internal/server/mcp.go b/internal/server/mcp.go
index 06a84b5e0..34071f561 100644
--- a/internal/server/mcp.go
+++ b/internal/server/mcp.go
@@ -1166,18 +1166,18 @@ func (p *MCPProxyServer) buildManagementTools() []mcpserver.ServerTool {
 	// quarantine_security - Security quarantine management
 	{
 		quarantineSecurityTool := mcp.NewTool("quarantine_security",
-			mcp.WithDescription("Security quarantine management for MCP servers and tools. Review and manage quarantined servers and tools to prevent Tool Poisoning Attacks (TPAs). Supports server-level quarantine and tool-level approval for individual tool description/schema changes. NOTE: Unquarantining servers is only available through manual config editing or system tray UI for security."),
+			mcp.WithDescription("Security quarantine management AND TPA scanning for MCP servers and tools. Review and manage quarantined servers and tools to prevent Tool Poisoning Attacks (TPAs), and scan a server for them: 'scan_server' runs the always-on offline baseline scan (in-process, no Docker required) and 'get_scan_report' returns the latest verdict and findings. Every listing/inspection response also carries a one-line scan status, so an unscanned server is visible as unscanned. Supports server-level quarantine and tool-level approval for individual tool description/schema changes. NOTE: Unquarantining servers is only available through manual config editing or system tray UI for security."),
 			mcp.WithTitleAnnotation("Quarantine Security"),
 			mcp.WithDestructiveHintAnnotation(true),
 			mcp.WithReadOnlyHintAnnotation(false),
 			mcp.WithOpenWorldHintAnnotation(false),
 			mcp.WithString("operation",
 				mcp.Required(),
-				mcp.Description("Security operation: list_quarantined, inspect_quarantined, quarantine_server, inspect_tools, approve_tool, approve_all_tools, block_tool, block_all_tools, enable_tool, disable_tool, inspect_prompts, approve_prompt, approve_all_prompts. 'block_tool'/'block_all_tools' atomically approve AND disable a tool (acknowledge it but keep it hidden) — all-or-nothing so a tool is never left approved+enabled. The prompt operations (spec 100) manage aggregated upstream prompts held by the metadata rug-pull baseline: a prompt whose advertised metadata changed since approval is withheld from prompts/list until approved."),
-				mcp.Enum("list_quarantined", "inspect_quarantined", "quarantine_server", "inspect_tools", "approve_tool", "approve_all_tools", "block_tool", "block_all_tools", "enable_tool", "disable_tool", "inspect_prompts", "approve_prompt", "approve_all_prompts"),
+				mcp.Description("Security operation: list_quarantined, inspect_quarantined, quarantine_server, inspect_tools, approve_tool, approve_all_tools, block_tool, block_all_tools, enable_tool, disable_tool, inspect_prompts, approve_prompt, approve_all_prompts, scan_server, get_scan_report. 'block_tool'/'block_all_tools' atomically approve AND disable a tool (acknowledge it but keep it hidden) — all-or-nothing so a tool is never left approved+enabled. The prompt operations (spec 100) manage aggregated upstream prompts held by the metadata rug-pull baseline: a prompt whose advertised metadata changed since approval is withheld from prompts/list until approved. 'scan_server' starts the offline TPA baseline scan for one server (no Docker needed) and returns the verdict once it settles, or a job id to poll; 'get_scan_report' returns that server's latest verdict, counts and findings."),
+				mcp.Enum("list_quarantined", "inspect_quarantined", "quarantine_server", "inspect_tools", "approve_tool", "approve_all_tools", "block_tool", "block_all_tools", "enable_tool", "disable_tool", "inspect_prompts", "approve_prompt", "approve_all_prompts", "scan_server", "get_scan_report"),
 			),
 			mcp.WithString("name",
-				mcp.Description("Server name (required for inspect_quarantined, quarantine_server, inspect_tools, approve_tool, approve_all_tools, block_tool, block_all_tools, approve_prompt, approve_all_prompts)"),
+				mcp.Description("Server name (required for inspect_quarantined, quarantine_server, inspect_tools, approve_tool, approve_all_tools, block_tool, block_all_tools, approve_prompt, approve_all_prompts, scan_server, get_scan_report)"),
 			),
 			mcp.WithString("tool_name",
 				mcp.Description("Tool name (required for approve_tool and block_tool operations)"),
@@ -3404,10 +3404,16 @@ func (p *MCPProxyServer) handleQuarantineSecurity(ctx context.Context, request m
 		result, opErr = p.handleListQuarantinedUpstreams(ctx)
 	case "inspect_quarantined":
 		result, opErr = p.handleInspectQuarantinedTools(ctx, request)
-	case "quarantine":
+	// "quarantine_server" is the name advertised in the operation enum;
+	// "quarantine" is the historical spelling kept working for older agents.
+	case "quarantine_server", "quarantine":
 		result, opErr = p.handleQuarantineUpstream(ctx, request)
 	case "inspect_tools":
-		result, opErr = p.handleInspectToolApprovals(request)
+		result, opErr = p.handleInspectToolApprovals(ctx, request)
+	case "scan_server":
+		result, opErr = p.handleScanServer(ctx, request)
+	case "get_scan_report":
+		result, opErr = p.handleGetScanReport(ctx, request)
 	case "approve_tool":
 		result, opErr = p.handleApproveToolByName(request)
 	case "approve_all_tools":
@@ -3457,7 +3463,7 @@ func (p *MCPProxyServer) handleQuarantineSecurity(ctx context.Context, request m
 }
 
 // handleInspectToolApprovals shows tool-level quarantine status for a server (Spec 032)
-func (p *MCPProxyServer) handleInspectToolApprovals(request mcp.CallToolRequest) (*mcp.CallToolResult, error) {
+func (p *MCPProxyServer) handleInspectToolApprovals(ctx context.Context, request mcp.CallToolRequest) (*mcp.CallToolResult, error) {
 	serverName := request.GetString("name", "")
 	if serverName == "" {
 		return mcp.NewToolResultError("Missing required parameter 'name' (server name)"), nil
@@ -3468,8 +3474,10 @@ func (p *MCPProxyServer) handleInspectToolApprovals(request mcp.CallToolRequest)
 		return mcp.NewToolResultError(fmt.Sprintf("Failed to list tool approvals: %v", err)), nil
 	}
 
+	scanStatus := p.scanStatusLine(ctx, serverName)
+
 	if len(records) == 0 {
-		return mcp.NewToolResultText(fmt.Sprintf("No tool approval records found for server '%s'", serverName)), nil
+		return mcp.NewToolResultText(fmt.Sprintf("No tool approval records found for server '%s' (scan status: %s)", serverName, scanStatus)), nil
 	}
 
 	pendingCount, changedCount, approvedCount, disabledCount := 0, 0, 0, 0
@@ -3509,6 +3517,7 @@ func (p *MCPProxyServer) handleInspectToolApprovals(request mcp.CallToolRequest)
 
 	result := map[string]interface{}{
 		"server_name":    serverName,
+		"scan_status":    scanStatus,
 		"tools":          toolList,
 		"total":          len(records),
 		"approved_count": approvedCount,
@@ -4095,15 +4104,26 @@ func (p *MCPProxyServer) getDockerContainerInfo(client *managed.Client) map[stri
 	return result
 }
 
-func (p *MCPProxyServer) handleListQuarantinedUpstreams(_ context.Context) (*mcp.CallToolResult, error) {
+func (p *MCPProxyServer) handleListQuarantinedUpstreams(ctx context.Context) (*mcp.CallToolResult, error) {
 	servers, err := p.storage.ListQuarantinedUpstreamServers()
 	if err != nil {
 		return mcp.NewToolResultError(fmt.Sprintf("Failed to list quarantined upstreams: %v", err)), nil
 	}
 
+	names := make([]string, 0, len(servers))
+	for _, sc := range servers {
+		if sc != nil {
+			names = append(names, sc.Name)
+		}
+	}
+
 	jsonResult, err := json.Marshal(map[string]interface{}{
 		"servers": servers,
 		"total":   len(servers),
+		// One line per server so "nobody ever scanned this" is visible right
+		// here, next to the decision it should inform.
+		"scan_status": p.scanStatusLines(ctx, names),
+		"scan_hint":   "Use operation='scan_server' name='<server>' to run the offline TPA baseline scan, then operation='get_scan_report' for the findings.",
 	})
 	if err != nil {
 		return mcp.NewToolResultError(fmt.Sprintf("Failed to serialize quarantined upstreams: %v", err)), nil
@@ -4369,6 +4389,7 @@ func (p *MCPProxyServer) handleInspectQuarantinedTools(ctx context.Context, requ
 	response := map[string]interface{}{
 		"server":            serverName,
 		"quarantine_status": "ACTIVE",
+		"scan_status":       p.scanStatusLine(ctx, serverName),
 		"tools":             toolsAnalysis,
 		"total_tools":       len(toolsAnalysis),
 		"analysis_purpose":  "SECURITY_INSPECTION",
diff --git a/internal/server/mcp_menu_surface_test.go b/internal/server/mcp_menu_surface_test.go
index 568efe4cf..88ddd4518 100644
--- a/internal/server/mcp_menu_surface_test.go
+++ b/internal/server/mcp_menu_surface_test.go
@@ -156,6 +156,8 @@ func TestMenuSurface_ExactDeltaFromPreFeature(t *testing.T) {
 					assertCallToolVariantDelta(t, surface, name, preM, curM)
 				case name == "code_execution":
 					assertCodeExecutionDelta(t, surface, preM, curM)
+				case name == "quarantine_security":
+					assertQuarantineSecurityDelta(t, surface, preM, curM)
 				default:
 					assert.Equal(t, preM, curM,
 						"surface %s: tool %q must be byte-identical to the pre-feature snapshot (SC-003)", surface, name)
@@ -260,6 +262,104 @@ func assertRetrieveToolsDelta(t *testing.T, surface string, preM, curM map[strin
 		"surface %s: retrieve_tools description must reference compact signatures (spec 085 FR-014)", surface)
 }
 
+// quarantineScanOperations are the operations that made TPA scanning reachable
+// from quarantine_security — the surface agents already use for held servers.
+var quarantineScanOperations = []string{"scan_server", "get_scan_report"}
+
+// schemaWithout copies a JSON-schema fragment minus the named keys, so a
+// comparison can freeze "everything except the parts this feature is allowed to
+// move". A nil fragment copies to an empty map, so a lost parameter compares
+// unequal to a present one instead of silently matching.
+func schemaWithout(schema map[string]interface{}, drop ...string) map[string]interface{} {
+	out := make(map[string]interface{}, len(schema))
+	for k, v := range schema {
+		out[k] = v
+	}
+	for _, k := range drop {
+		delete(out, k)
+	}
+	return out
+}
+
+// assertQuarantineSecurityDelta: quarantine_security may grow the two scan
+// operations and the prose that documents them, and NOTHING else. In
+// particular it takes no new parameter — both operations reuse `name` — so the
+// parameter SET and every parameter schema except `operation` must be
+// byte-identical to the pre-feature snapshot.
+func assertQuarantineSecurityDelta(t *testing.T, surface string, preM, curM map[string]interface{}) {
+	t.Helper()
+
+	preProps, curProps := schemaProps(preM), schemaProps(curM)
+	require.NotNil(t, curProps, "surface %s: quarantine_security lost its inputSchema", surface)
+	assert.Equal(t, sortedKeys(preProps), sortedKeys(curProps),
+		"surface %s: the scan operations reuse existing parameters — none may be added", surface)
+
+	for p, preSchema := range preProps {
+		if p == "operation" {
+			continue
+		}
+		if p == "name" {
+			// `name` is now required for the scan ops too, so its description
+			// lists them; EVERY other key of its schema must be byte-equal.
+			// Comparing only `type` here would let a later regeneration slip a
+			// new `pattern`, `enum` or `default` onto the parameter unnoticed —
+			// the exact drift these frozen goldens exist to catch.
+			preName, _ := preSchema.(map[string]interface{})
+			curName, _ := curProps[p].(map[string]interface{})
+			require.NotNil(t, curName, "surface %s: quarantine_security lost its name parameter", surface)
+			assert.Equal(t, schemaWithout(preName, "description"), schemaWithout(curName, "description"),
+				"surface %s: only name's description may move — every other constraint is frozen", surface)
+			for _, op := range quarantineScanOperations {
+				assert.Contains(t, curName["description"], op,
+					"surface %s: name must document that %s requires it", surface, op)
+			}
+			continue
+		}
+		assert.Equal(t, preSchema, curProps[p],
+			"surface %s: pre-feature quarantine_security parameter %q must be preserved unchanged", surface, p)
+	}
+
+	// The operation enum grows by exactly the scan operations, appended after
+	// every pre-feature value in its original order.
+	preOp, _ := preProps["operation"].(map[string]interface{})
+	curOp, _ := curProps["operation"].(map[string]interface{})
+	require.NotNil(t, curOp, "surface %s: quarantine_security lost its operation parameter", surface)
+	preEnum, _ := preOp["enum"].([]interface{})
+	curEnum, _ := curOp["enum"].([]interface{})
+	wantEnum := append([]interface{}{}, preEnum...)
+	for _, op := range quarantineScanOperations {
+		wantEnum = append(wantEnum, op)
+	}
+	assert.Equal(t, wantEnum, curEnum,
+		"surface %s: the operation enum grows by exactly %v", surface, quarantineScanOperations)
+
+	// …and the REST of the operation schema is frozen. Checking only the enum
+	// would let `type` change, or a new constraint appear beside it, on the one
+	// parameter this feature is allowed to touch — the widest blind spot the
+	// helper could have.
+	assert.Equal(t, schemaWithout(preOp, "enum", "description"), schemaWithout(curOp, "enum", "description"),
+		"surface %s: apart from the enum and its prose, operation's schema is frozen", surface)
+
+	// Annotations and required list unchanged.
+	assert.Equal(t, preM["annotations"], curM["annotations"],
+		"surface %s: quarantine_security annotations unchanged", surface)
+	preSchema, _ := preM["inputSchema"].(map[string]interface{})
+	curSchema, _ := curM["inputSchema"].(map[string]interface{})
+	assert.Equal(t, preSchema["required"], curSchema["required"],
+		"surface %s: quarantine_security required params unchanged", surface)
+
+	// The tool description must actually advertise scanning — the discovery
+	// gap this change exists to close (the tool never mentioned scanning, so
+	// agents never found the scanner).
+	curDesc, _ := curM["description"].(string)
+	assert.Contains(t, strings.ToLower(curDesc), "scan",
+		"surface %s: quarantine_security description must mention scanning", surface)
+	for _, op := range quarantineScanOperations {
+		assert.Contains(t, curDesc, op,
+			"surface %s: quarantine_security description must name %s", surface, op)
+	}
+}
+
 // FR-009: the three registrations are built independently, which is exactly
 // how the default one drifted into omitting the filter parameters. They must
 // now come from one shared helper — asserted by deep-comparing the produced
diff --git a/internal/server/mcp_quarantine_scan.go b/internal/server/mcp_quarantine_scan.go
new file mode 100644
index 000000000..163e7a552
--- /dev/null
+++ b/internal/server/mcp_quarantine_scan.go
@@ -0,0 +1,313 @@
+package server
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"time"
+
+	"github.com/mark3labs/mcp-go/mcp"
+
+	"github.com/smart-mcp-proxy/mcpproxy-go/internal/security/scanner"
+)
+
+// Scanning through quarantine_security (the surface agents actually reach for
+// when a server is held). The TPA scanner shipped with no MCP entry point at
+// all: an agent could list, inspect and approve quarantined tools but had no
+// way to ask "has this server been scanned, and what did the scan say?" — the
+// answer lived only in the web UI and the CLI.
+
+const (
+	// scanVerdictWait is how long scan_server waits for the just-started
+	// Pass-1 scan to settle before answering "started, poll get_scan_report".
+	// The in-process baseline scan on a connected server finishes well inside
+	// this; anything slower (a cold upstream that has to connect first) is
+	// reported as async rather than holding the agent's call open.
+	scanVerdictWait = 8 * time.Second
+
+	// scanVerdictPoll is the polling interval used while waiting.
+	scanVerdictPoll = 250 * time.Millisecond
+
+	// scanReportMaxFindings caps how many findings get inlined into a
+	// get_scan_report response. The full report stays available over REST and
+	// in the web UI; an MCP response is a token budget.
+	scanReportMaxFindings = 10
+
+	// neverScannedHint is the one-line status carried by list/inspect
+	// responses for a server with no scan on record.
+	neverScannedHint = "never scanned — run scan_server first"
+
+	// scanSummaryStatusRunning is the sentinel ScanSummary.Status the scanner
+	// service reports while a Pass-1 scan is still registered as active.
+	scanSummaryStatusRunning = "scanning"
+)
+
+// securityScanner returns the scanner service backing the scan operations, or
+// nil when this process has none (scanner disabled, or a test proxy without a
+// main server).
+func (p *MCPProxyServer) securityScanner() securityScannerService {
+	if p.mainServer == nil {
+		return nil
+	}
+	return p.mainServer.securityScannerSvc()
+}
+
+// scannerUnavailableResult is the shared "no scanner here" answer. It names the
+// reason rather than pretending the server is clean.
+func scannerUnavailableResult(operation string) *mcp.CallToolResult {
+	return mcp.NewToolResultError(fmt.Sprintf(
+		"Security scanning is unavailable in this process, so '%s' cannot run. Scanning requires the mcpproxy core (not a stdio-only proxy).", operation))
+}
+
+// handleScanServer triggers a Pass-1 (offline baseline) security scan for a
+// server and reports the verdict if the scan settles quickly.
+func (p *MCPProxyServer) handleScanServer(ctx context.Context, request mcp.CallToolRequest) (*mcp.CallToolResult, error) {
+	serverName := request.GetString("name", "")
+	if serverName == "" {
+		return mcp.NewToolResultError("Missing required parameter 'name' (server name)"), nil
+	}
+
+	svc := p.securityScanner()
+	if svc == nil {
+		return scannerUnavailableResult("scan_server"), nil
+	}
+
+	job, err := svc.StartScan(ctx, serverName, false, nil, "")
+	if err != nil {
+		return mcp.NewToolResultError(fmt.Sprintf("Failed to start scan for server '%s': %v", serverName, err)), nil
+	}
+
+	response := map[string]interface{}{
+		"operation":   "scan_server",
+		"server_name": serverName,
+		"scan_pass":   "baseline",
+		"note":        "The offline baseline scan runs in-process and needs no Docker. Optional deep scanners (Docker) run only when deep scan is enabled.",
+	}
+	jobID := ""
+	if job != nil {
+		jobID = job.ID
+		response["job_id"] = job.ID
+	}
+
+	if summary := p.awaitScanVerdict(ctx, svc, serverName, jobID); summary != nil {
+		response["status"] = "completed"
+		response["verdict"] = summary.Status
+		response["risk_score"] = summary.RiskScore
+		if summary.FindingCounts != nil {
+			response["finding_counts"] = summary.FindingCounts
+		}
+		if summary.LastScanAt != nil {
+			response["last_scan_at"] = summary.LastScanAt.UTC().Format(time.RFC3339)
+		}
+		response["next_steps"] = fmt.Sprintf("Use operation='get_scan_report' name='%s' for the findings.", serverName)
+	} else {
+		response["status"] = "scan started"
+		response["next_steps"] = fmt.Sprintf("Scan is still running. Use operation='get_scan_report' name='%s' to read the verdict.", serverName)
+	}
+
+	return jsonToolResult(response, "scan result")
+}
+
+// awaitScanVerdict polls until the scan job reaches a terminal state, then
+// returns the resulting summary. Returns nil on timeout, on context
+// cancellation, or when no summary is available — the caller then answers
+// "scan started" instead of inventing a verdict.
+func (p *MCPProxyServer) awaitScanVerdict(ctx context.Context, svc securityScannerService, serverName, jobID string) *scanner.ScanSummary {
+	deadline := time.Now().Add(scanVerdictWait)
+	ticker := time.NewTicker(scanVerdictPoll)
+	defer ticker.Stop()
+
+	for {
+		// Pass 1 (the offline baseline) is the pass scan_server started and the
+		// only one whose verdict this call promises. GetScanStatus answers with
+		// whatever job is ACTIVE for the server, and a completed Pass 1
+		// auto-starts the Pass-2 deep audit when deep scan is on — that Pass-2
+		// job's id never matches, so polling the generic status would time out
+		// on a baseline verdict that was already sitting there.
+		job, err := svc.GetScanStatusByPass(ctx, serverName, scanner.ScanPassSecurityScan)
+		if err == nil && job != nil && scanJobSettled(job.Status) && (jobID == "" || job.ID == jobID) {
+			// The engine flips the job to a terminal status BEFORE its
+			// completion callback persists the report and BEFORE the job is
+			// dropped from the active map. A summary read inside that window
+			// still answers "scanning", which would be reported here as
+			// status=completed + verdict=scanning — a verdict that reads as a
+			// clean-ish result but is really "not known yet". Keep polling
+			// until the settled job's own verdict is visible, or time out into
+			// the async answer.
+			if summary := svc.GetScanSummary(ctx, serverName); summary != nil && summary.Status != scanSummaryStatusRunning {
+				return summary
+			}
+		}
+
+		if time.Now().After(deadline) {
+			return nil
+		}
+		select {
+		case <-ctx.Done():
+			return nil
+		case <-ticker.C:
+		}
+	}
+}
+
+// runningScanJobID returns the id of the server's current Pass-1 job while it
+// is still running, or "" when there is none (or it cannot be resolved). It is
+// how get_scan_report tells a partial report of the running scan apart from the
+// previous scan's finished one.
+func (p *MCPProxyServer) runningScanJobID(ctx context.Context, svc securityScannerService, serverName string) string {
+	job, err := svc.GetScanStatusByPass(ctx, serverName, scanner.ScanPassSecurityScan)
+	if err != nil || job == nil || scanJobSettled(job.Status) {
+		return ""
+	}
+	return job.ID
+}
+
+func scanJobSettled(status string) bool {
+	switch status {
+	case scanner.ScanJobStatusCompleted, scanner.ScanJobStatusFailed, scanner.ScanJobStatusCancelled:
+		return true
+	default:
+		return false
+	}
+}
+
+// handleGetScanReport returns the latest scan verdict + findings for a server.
+func (p *MCPProxyServer) handleGetScanReport(ctx context.Context, request mcp.CallToolRequest) (*mcp.CallToolResult, error) {
+	serverName := request.GetString("name", "")
+	if serverName == "" {
+		return mcp.NewToolResultError("Missing required parameter 'name' (server name)"), nil
+	}
+
+	svc := p.securityScanner()
+	if svc == nil {
+		return scannerUnavailableResult("get_scan_report"), nil
+	}
+
+	summary := svc.GetScanSummary(ctx, serverName)
+	report, reportErr := svc.GetScanReport(ctx, serverName)
+	if summary == nil && (reportErr != nil || report == nil) {
+		return jsonToolResult(map[string]interface{}{
+			"operation":   "get_scan_report",
+			"server_name": serverName,
+			"scan_status": neverScannedHint,
+			"next_steps":  fmt.Sprintf("Use operation='scan_server' name='%s' to run the offline baseline scan.", serverName),
+		}, "scan report")
+	}
+
+	response := map[string]interface{}{
+		"operation":   "get_scan_report",
+		"server_name": serverName,
+		"scan_status": scanStatusLineFrom(summary, serverName),
+	}
+	if summary != nil {
+		response["verdict"] = summary.Status
+		response["risk_score"] = summary.RiskScore
+		if summary.FindingCounts != nil {
+			response["finding_counts"] = summary.FindingCounts
+		}
+		if summary.LastScanAt != nil {
+			response["last_scan_at"] = summary.LastScanAt.UTC().Format(time.RFC3339)
+		}
+		response["scanners_run"] = summary.ScannersRun
+		response["scanners_failed"] = summary.ScannersFailed
+		response["scanners_total"] = summary.ScannersTotal
+		if summary.DeepScan != nil {
+			response["deep_scan"] = summary.DeepScan
+		}
+	}
+
+	if reportErr == nil && report != nil {
+		response["job_id"] = report.JobID
+		if summary == nil {
+			response["verdict"] = report.Verdict
+			response["risk_score"] = report.RiskScore
+		}
+		// The summary and the report are two independent latest-by-server
+		// reads, so while a scan is running these findings are NOT a settled
+		// verdict — and they may come from either job: per-scanner reports are
+		// persisted as each scanner finishes, so the report can be the running
+		// job's partial output, or still the previous job's. Attaching them
+		// unlabelled would read as the running scan's finished result, so name
+		// which of the two they actually are.
+		if summary != nil && summary.Status == scanSummaryStatusRunning {
+			if runningID := p.runningScanJobID(ctx, svc, serverName); runningID != "" && runningID == report.JobID {
+				response["findings_from"] = "the scan currently running — partial results, re-run get_scan_report for the final verdict"
+			} else {
+				response["findings_from"] = "the previous completed scan — a new scan is still running; re-run get_scan_report for its verdict"
+			}
+		}
+		response["findings_total"] = len(report.Findings)
+		findings := make([]map[string]interface{}, 0, scanReportMaxFindings)
+		for i, f := range report.Findings {
+			if i >= scanReportMaxFindings {
+				response["findings_truncated"] = len(report.Findings) - scanReportMaxFindings
+				break
+			}
+			finding := map[string]interface{}{
+				"rule_id":      f.RuleID,
+				"title":        f.Title,
+				"severity":     f.Severity,
+				"threat_level": f.ThreatLevel,
+				"threat_type":  f.ThreatType,
+				"scanner":      f.Scanner,
+			}
+			if f.Location != "" {
+				finding["location"] = f.Location
+			}
+			if f.Description != "" {
+				finding["description"] = f.Description
+			}
+			findings = append(findings, finding)
+		}
+		response["findings"] = findings
+	}
+
+	return jsonToolResult(response, "scan report")
+}
+
+// scanStatusLineFrom renders the one-line scan status carried by every
+// quarantine_security listing/inspection response.
+func scanStatusLineFrom(summary *scanner.ScanSummary, serverName string) string {
+	if summary == nil {
+		return neverScannedHint
+	}
+	if summary.Status == scanSummaryStatusRunning {
+		return fmt.Sprintf("scan running for '%s' — re-run get_scan_report shortly", serverName)
+	}
+	line := fmt.Sprintf("last scan verdict: %s (risk %d)", summary.Status, summary.RiskScore)
+	if summary.LastScanAt != nil {
+		line += fmt.Sprintf(", scanned %s", summary.LastScanAt.UTC().Format(time.RFC3339))
+	}
+	return line
+}
+
+// scanStatusLine resolves the one-line scan status for a server, tolerating a
+// process with no scanner at all.
+func (p *MCPProxyServer) scanStatusLine(ctx context.Context, serverName string) string {
+	svc := p.securityScanner()
+	if svc == nil {
+		return "scan status unavailable — this process runs no security scanner"
+	}
+	return scanStatusLineFrom(svc.GetScanSummary(ctx, serverName), serverName)
+}
+
+// scanStatusLines resolves scan status for a batch of servers (list_quarantined).
+func (p *MCPProxyServer) scanStatusLines(ctx context.Context, serverNames []string) map[string]string {
+	lines := make(map[string]string, len(serverNames))
+	for _, name := range serverNames {
+		if name == "" {
+			continue
+		}
+		lines[name] = p.scanStatusLine(ctx, name)
+	}
+	return lines
+}
+
+// jsonToolResult marshals a response map into an MCP text result.
+func jsonToolResult(payload map[string]interface{}, what string) (*mcp.CallToolResult, error) {
+	jsonBytes, err := json.Marshal(payload)
+	if err != nil {
+		return mcp.NewToolResultError(fmt.Sprintf("Failed to serialize %s: %v", what, err)), nil
+	}
+	return mcp.NewToolResultText(string(jsonBytes)), nil
+}
diff --git a/internal/server/mcp_quarantine_scan_test.go b/internal/server/mcp_quarantine_scan_test.go
new file mode 100644
index 000000000..6c8d1d0b1
--- /dev/null
+++ b/internal/server/mcp_quarantine_scan_test.go
@@ -0,0 +1,468 @@
+package server
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"testing"
+	"time"
+
+	"github.com/mark3labs/mcp-go/mcp"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/smart-mcp-proxy/mcpproxy-go/internal/config"
+	"github.com/smart-mcp-proxy/mcpproxy-go/internal/security/scanner"
+	"github.com/smart-mcp-proxy/mcpproxy-go/internal/storage"
+)
+
+// quarantine_security is the security surface agents actually reach for, and it
+// had no way to run or read a TPA scan. These tests cover the two operations
+// that close that gap (scan_server / get_scan_report) plus the one-line scan
+// status every listing/inspection response now carries.
+
+// scanTestProxy builds a proxy wired to a real runtime plus a fake scanner
+// service, and returns both so a test can pin scan fixtures.
+func scanTestProxy(t *testing.T, servers ...*config.ServerConfig) (*MCPProxyServer, *fakeSecurityScanner) {
+	t.Helper()
+	proxy, rt := createTestProxyWithRuntime(t, servers)
+	// list_quarantined reads the persisted upstream list, mirroring production
+	// where an added server is always saved to BBolt.
+	for _, sc := range servers {
+		require.NoError(t, rt.StorageManager().SaveUpstreamServer(sc))
+	}
+	fake := newFakeSecurityScanner()
+	proxy.mainServer.securityScanner = fake
+	return proxy, fake
+}
+
+func decodeToolJSON(t *testing.T, result *mcp.CallToolResult) map[string]interface{} {
+	t.Helper()
+	require.NotNil(t, result)
+	require.NotEmpty(t, result.Content)
+	text, ok := result.Content[0].(mcp.TextContent)
+	require.True(t, ok, "expected text content")
+	var payload map[string]interface{}
+	require.NoError(t, json.Unmarshal([]byte(text.Text), &payload), "response must be JSON: %s", text.Text)
+	return payload
+}
+
+func settledSummary(status string, risk int) *scanner.ScanSummary {
+	at := time.Date(2026, 8, 20, 10, 0, 0, 0, time.UTC)
+	return &scanner.ScanSummary{
+		LastScanAt:    &at,
+		RiskScore:     risk,
+		Status:        status,
+		FindingCounts: &scanner.FindingCounts{Dangerous: 1, Total: 1},
+		ScannersRun:   1,
+		ScannersTotal: 1,
+	}
+}
+
+// TestQuarantineSecurity_ScanServer_ReturnsVerdictWhenScanSettles is the happy
+// path: the operation starts a scan and, because the baseline scan finishes
+// in-process, answers with the verdict rather than only a job id.
+func TestQuarantineSecurity_ScanServer_ReturnsVerdictWhenScanSettles(t *testing.T) {
+	proxy, fake := scanTestProxy(t, &config.ServerConfig{Name: "github", Enabled: true, Quarantined: true})
+	fake.onStartScan = func(serverName string) {
+		fake.setScanResult(serverName,
+			&scanner.ScanJob{ID: "job-1", ServerName: serverName, Status: scanner.ScanJobStatusCompleted},
+			settledSummary("dangerous", 80))
+	}
+
+	result, err := proxy.handleQuarantineSecurity(context.Background(), quarantineRequest(map[string]interface{}{
+		"operation": "scan_server",
+		"name":      "github",
+	}))
+	require.NoError(t, err)
+	require.False(t, result.IsError, "scan_server must succeed")
+
+	payload := decodeToolJSON(t, result)
+	assert.Equal(t, []string{"github"}, fake.startedScans(), "the scan is actually triggered")
+	assert.Equal(t, "completed", payload["status"])
+	assert.Equal(t, "dangerous", payload["verdict"])
+	assert.Equal(t, float64(80), payload["risk_score"])
+	assert.Equal(t, "job-1", payload["job_id"])
+	assert.Contains(t, payload["next_steps"], "get_scan_report")
+}
+
+// TestQuarantineSecurity_ScanServer_AsyncWhenScanStillRunning covers the other
+// branch: a scan that has not settled must report "scan started" with a job id,
+// never a fabricated verdict.
+func TestQuarantineSecurity_ScanServer_AsyncWhenScanStillRunning(t *testing.T) {
+	proxy, fake := scanTestProxy(t, &config.ServerConfig{Name: "github", Enabled: true})
+	fake.setScanResult("github",
+		&scanner.ScanJob{ID: "job-2", ServerName: "github", Status: scanner.ScanJobStatusRunning},
+		nil)
+
+	// Keep the test fast: the wait loop honours context cancellation.
+	ctx, cancel := context.WithTimeout(context.Background(), 50*time.Millisecond)
+	defer cancel()
+
+	result, err := proxy.handleQuarantineSecurity(ctx, quarantineRequest(map[string]interface{}{
+		"operation": "scan_server",
+		"name":      "github",
+	}))
+	require.NoError(t, err)
+	require.False(t, result.IsError)
+
+	payload := decodeToolJSON(t, result)
+	assert.Equal(t, "scan started", payload["status"])
+	assert.Equal(t, "job-2", payload["job_id"])
+	assert.NotContains(t, payload, "verdict", "an unfinished scan has no verdict to report")
+}
+
+// TestQuarantineSecurity_ScanServer_NeverReportsScanningAsAVerdict covers the
+// completion window inside the scanner engine: it flips the job to a terminal
+// status BEFORE the completion callback persists the report and before the job
+// leaves the active map, so a summary read in between still answers "scanning".
+// Reporting that pair verbatim would produce status=completed with
+// verdict=scanning — a non-verdict that reads like a result. The wait must keep
+// polling and fall back to the honest async answer.
+func TestQuarantineSecurity_ScanServer_NeverReportsScanningAsAVerdict(t *testing.T) {
+	proxy, fake := scanTestProxy(t, &config.ServerConfig{Name: "github", Enabled: true})
+	fake.setScanResult("github",
+		&scanner.ScanJob{ID: "job-window", ServerName: "github", Status: scanner.ScanJobStatusCompleted},
+		&scanner.ScanSummary{Status: "scanning"})
+
+	// Bound the wait: the loop honours context cancellation.
+	ctx, cancel := context.WithTimeout(context.Background(), 400*time.Millisecond)
+	defer cancel()
+
+	result, err := proxy.handleQuarantineSecurity(ctx, quarantineRequest(map[string]interface{}{
+		"operation": "scan_server",
+		"name":      "github",
+	}))
+	require.NoError(t, err)
+	require.False(t, result.IsError)
+
+	payload := decodeToolJSON(t, result)
+	assert.Equal(t, "scan started", payload["status"])
+	assert.NotContains(t, payload, "verdict", "'scanning' is not a verdict")
+	assert.Equal(t, "job-window", payload["job_id"])
+}
+
+// TestQuarantineSecurity_ScanServer_WaitsThroughTheCompletionWindow is the
+// other half: once the completion callback lands and the summary carries a real
+// verdict, the still-open call reports it rather than timing out into async.
+func TestQuarantineSecurity_ScanServer_WaitsThroughTheCompletionWindow(t *testing.T) {
+	proxy, fake := scanTestProxy(t, &config.ServerConfig{Name: "github", Enabled: true})
+	fake.setScanResult("github",
+		&scanner.ScanJob{ID: "job-late", ServerName: "github", Status: scanner.ScanJobStatusCompleted},
+		&scanner.ScanSummary{Status: "scanning"})
+
+	go func() {
+		time.Sleep(300 * time.Millisecond)
+		fake.setScanResult("github",
+			&scanner.ScanJob{ID: "job-late", ServerName: "github", Status: scanner.ScanJobStatusCompleted},
+			settledSummary("clean", 0))
+	}()
+
+	result, err := proxy.handleQuarantineSecurity(context.Background(), quarantineRequest(map[string]interface{}{
+		"operation": "scan_server",
+		"name":      "github",
+	}))
+	require.NoError(t, err)
+	require.False(t, result.IsError)
+
+	payload := decodeToolJSON(t, result)
+	assert.Equal(t, "completed", payload["status"])
+	assert.Equal(t, "clean", payload["verdict"])
+	assert.Equal(t, "job-late", payload["job_id"])
+}
+
+// TestQuarantineSecurity_ScanServer_Pass2DoesNotMaskTheBaselineVerdict: with
+// deep scan enabled, a completed Pass 1 auto-starts the Pass-2 supply-chain
+// audit, which becomes the server's ACTIVE job. Polling the generic scan status
+// would then see a job whose id never matches the one scan_server started and
+// time out into "scan started" — hiding a baseline verdict that was already
+// available. The wait polls Pass 1 specifically.
+func TestQuarantineSecurity_ScanServer_Pass2DoesNotMaskTheBaselineVerdict(t *testing.T) {
+	proxy, fake := scanTestProxy(t, &config.ServerConfig{Name: "github", Enabled: true})
+	// The ACTIVE job for this server is the Pass-2 audit; Pass 1 is the job
+	// scan_server started and the one whose verdict it promised.
+	fake.setScanResult("github",
+		&scanner.ScanJob{ID: "job-pass2", ServerName: "github", Status: scanner.ScanJobStatusRunning},
+		settledSummary("clean", 0))
+	fake.setPassJob("github", scanner.ScanPassSecurityScan,
+		&scanner.ScanJob{ID: "job-pass1", ServerName: "github", Status: scanner.ScanJobStatusRunning})
+
+	go func() {
+		time.Sleep(300 * time.Millisecond)
+		fake.setPassJob("github", scanner.ScanPassSecurityScan,
+			&scanner.ScanJob{ID: "job-pass1", ServerName: "github", Status: scanner.ScanJobStatusCompleted})
+	}()
+
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	result, err := proxy.handleQuarantineSecurity(ctx, quarantineRequest(map[string]interface{}{
+		"operation": "scan_server",
+		"name":      "github",
+	}))
+	require.NoError(t, err)
+	require.False(t, result.IsError)
+
+	payload := decodeToolJSON(t, result)
+	assert.Equal(t, "completed", payload["status"],
+		"the Pass-2 audit running in the background must not hide the settled baseline")
+	assert.Equal(t, "clean", payload["verdict"])
+	assert.Equal(t, "job-pass1", payload["job_id"], "scan_server reports the Pass-1 job it started")
+}
+
+// TestQuarantineSecurity_GetScanReport_LabelsPartialFindingsOfTheRunningScan is
+// the other half of the findings-provenance label: per-scanner reports are
+// persisted as each scanner finishes, so a running scan's own partial output
+// can be what GetScanReport returns. Calling that "the previous scan" is just as
+// wrong as leaving it unlabelled.
+func TestQuarantineSecurity_GetScanReport_LabelsPartialFindingsOfTheRunningScan(t *testing.T) {
+	proxy, fake := scanTestProxy(t, &config.ServerConfig{Name: "github", Enabled: true})
+	fake.setScanResult("github",
+		&scanner.ScanJob{ID: "job-live", ServerName: "github", Status: scanner.ScanJobStatusRunning},
+		&scanner.ScanSummary{Status: "scanning"})
+	fake.reports["github"] = &scanner.AggregatedReport{
+		JobID:      "job-live",
+		ServerName: "github",
+		Findings: []scanner.ScanFinding{{
+			RuleID:  "TPA-2026-0001",
+			Scanner: "tpa-descriptions",
+		}},
+	}
+
+	result, err := proxy.handleQuarantineSecurity(context.Background(), quarantineRequest(map[string]interface{}{
+		"operation": "get_scan_report",
+		"name":      "github",
+	}))
+	require.NoError(t, err)
+	require.False(t, result.IsError)
+
+	payload := decodeToolJSON(t, result)
+	assert.Equal(t, "job-live", payload["job_id"])
+	assert.Contains(t, payload["findings_from"], "currently running",
+		"a running job's own partial findings must not be labelled as a previous scan's")
+	assert.NotContains(t, payload["findings_from"], "previous")
+}
+
+// TestQuarantineSecurity_ScanServer_RequiresName pins the argument contract.
+func TestQuarantineSecurity_ScanServer_RequiresName(t *testing.T) {
+	proxy, _ := scanTestProxy(t)
+
+	result, err := proxy.handleQuarantineSecurity(context.Background(), quarantineRequest(map[string]interface{}{
+		"operation": "scan_server",
+	}))
+	require.NoError(t, err)
+	require.True(t, result.IsError)
+	assert.Contains(t, result.Content[0].(mcp.TextContent).Text, "'name'")
+}
+
+// TestQuarantineSecurity_ScanServer_ReportsStartFailure — a scan that cannot
+// start (disconnected server, no tool definitions) says so.
+func TestQuarantineSecurity_ScanServer_ReportsStartFailure(t *testing.T) {
+	proxy, fake := scanTestProxy(t, &config.ServerConfig{Name: "github", Enabled: true})
+	fake.startScanErr = errors.New("server is disconnected")
+
+	result, err := proxy.handleQuarantineSecurity(context.Background(), quarantineRequest(map[string]interface{}{
+		"operation": "scan_server",
+		"name":      "github",
+	}))
+	require.NoError(t, err)
+	require.True(t, result.IsError)
+	assert.Contains(t, result.Content[0].(mcp.TextContent).Text, "server is disconnected")
+}
+
+// TestQuarantineSecurity_GetScanReport_ReturnsVerdictAndFindings covers the
+// read side, including the finding projection.
+func TestQuarantineSecurity_GetScanReport_ReturnsVerdictAndFindings(t *testing.T) {
+	proxy, fake := scanTestProxy(t, &config.ServerConfig{Name: "github", Enabled: true})
+	fake.setScanResult("github",
+		&scanner.ScanJob{ID: "job-3", ServerName: "github", Status: scanner.ScanJobStatusCompleted},
+		settledSummary("warnings", 30))
+	fake.reports["github"] = &scanner.AggregatedReport{
+		JobID:      "job-3",
+		ServerName: "github",
+		Verdict:    "warnings",
+		RiskScore:  30,
+		Findings: []scanner.ScanFinding{{
+			RuleID:      "TPA-2026-0001",
+			Title:       "Hidden instructions in tool description",
+			Severity:    scanner.SeverityHigh,
+			ThreatLevel: "warning",
+			ThreatType:  "tool_poisoning",
+			Scanner:     "tpa-descriptions",
+			Location:    "tools.json",
+		}},
+	}
+
+	result, err := proxy.handleQuarantineSecurity(context.Background(), quarantineRequest(map[string]interface{}{
+		"operation": "get_scan_report",
+		"name":      "github",
+	}))
+	require.NoError(t, err)
+	require.False(t, result.IsError)
+
+	payload := decodeToolJSON(t, result)
+	assert.Equal(t, "warnings", payload["verdict"])
+	assert.Equal(t, "job-3", payload["job_id"])
+	assert.Equal(t, float64(1), payload["findings_total"])
+	findings, ok := payload["findings"].([]interface{})
+	require.True(t, ok)
+	require.Len(t, findings, 1)
+	assert.Equal(t, "TPA-2026-0001", findings[0].(map[string]interface{})["rule_id"])
+	assert.Contains(t, payload["scan_status"], "warnings")
+}
+
+// TestQuarantineSecurity_GetScanReport_LabelsPreviousFindingsWhileScanning:
+// the summary and the report are independent latest-by-server reads, so while a
+// new scan runs the report is still the PREVIOUS job's. Its findings must be
+// labelled as such, never presented as the running scan's result.
+func TestQuarantineSecurity_GetScanReport_LabelsPreviousFindingsWhileScanning(t *testing.T) {
+	proxy, fake := scanTestProxy(t, &config.ServerConfig{Name: "github", Enabled: true})
+	fake.setScanResult("github",
+		&scanner.ScanJob{ID: "job-new", ServerName: "github", Status: scanner.ScanJobStatusRunning},
+		&scanner.ScanSummary{Status: "scanning"})
+	fake.reports["github"] = &scanner.AggregatedReport{
+		JobID:      "job-old",
+		ServerName: "github",
+		Verdict:    "warnings",
+		RiskScore:  30,
+		Findings: []scanner.ScanFinding{{
+			RuleID:  "TPA-2026-0001",
+			Title:   "Hidden instructions in tool description",
+			Scanner: "tpa-descriptions",
+		}},
+	}
+
+	result, err := proxy.handleQuarantineSecurity(context.Background(), quarantineRequest(map[string]interface{}{
+		"operation": "get_scan_report",
+		"name":      "github",
+	}))
+	require.NoError(t, err)
+	require.False(t, result.IsError)
+
+	payload := decodeToolJSON(t, result)
+	assert.Contains(t, payload["scan_status"], "scan running")
+	assert.Equal(t, "job-old", payload["job_id"])
+	assert.Contains(t, payload, "findings_from",
+		"findings from an older job must say which scan they came from")
+	assert.Contains(t, payload["findings_from"], "previous")
+}
+
+// TestQuarantineSecurity_GetScanReport_NeverScanned is the honest empty state:
+// no report is NOT a clean verdict.
+func TestQuarantineSecurity_GetScanReport_NeverScanned(t *testing.T) {
+	proxy, _ := scanTestProxy(t, &config.ServerConfig{Name: "github", Enabled: true})
+
+	result, err := proxy.handleQuarantineSecurity(context.Background(), quarantineRequest(map[string]interface{}{
+		"operation": "get_scan_report",
+		"name":      "github",
+	}))
+	require.NoError(t, err)
+	require.False(t, result.IsError)
+
+	payload := decodeToolJSON(t, result)
+	assert.Equal(t, neverScannedHint, payload["scan_status"])
+	assert.NotContains(t, payload, "verdict")
+	assert.Contains(t, payload["next_steps"], "scan_server")
+}
+
+// TestQuarantineSecurity_ListQuarantined_CarriesScanStatus — the listing an
+// agent starts from must say whether each held server was ever scanned.
+func TestQuarantineSecurity_ListQuarantined_CarriesScanStatus(t *testing.T) {
+	proxy, fake := scanTestProxy(t,
+		&config.ServerConfig{Name: "scanned", Enabled: true, Quarantined: true},
+		&config.ServerConfig{Name: "unscanned", Enabled: true, Quarantined: true},
+	)
+	fake.setScanResult("scanned",
+		&scanner.ScanJob{ID: "job-4", ServerName: "scanned", Status: scanner.ScanJobStatusCompleted},
+		settledSummary("clean", 0))
+
+	result, err := proxy.handleQuarantineSecurity(context.Background(), quarantineRequest(map[string]interface{}{
+		"operation": "list_quarantined",
+	}))
+	require.NoError(t, err)
+	require.False(t, result.IsError)
+
+	payload := decodeToolJSON(t, result)
+	statuses, ok := payload["scan_status"].(map[string]interface{})
+	require.True(t, ok, "list_quarantined must carry per-server scan status")
+	assert.Contains(t, statuses["scanned"], "clean")
+	assert.Equal(t, neverScannedHint, statuses["unscanned"])
+	assert.Contains(t, payload["scan_hint"], "scan_server")
+}
+
+// TestQuarantineSecurity_InspectTools_CarriesScanStatus — same for the
+// tool-approval inspection, in both the populated and the empty state.
+func TestQuarantineSecurity_InspectTools_CarriesScanStatus(t *testing.T) {
+	proxy, fake := scanTestProxy(t, &config.ServerConfig{Name: "github", Enabled: true, Quarantined: true})
+	require.NoError(t, proxy.storage.SaveToolApproval(&storage.ToolApprovalRecord{
+		ServerName:         "github",
+		ToolName:           "create_issue",
+		Status:             storage.ToolApprovalStatusPending,
+		CurrentHash:        "h1",
+		CurrentDescription: "Creates a GitHub issue",
+		CurrentSchema:      `{"type":"object"}`,
+	}))
+
+	inspect := func() *mcp.CallToolResult {
+		result, err := proxy.handleQuarantineSecurity(context.Background(), quarantineRequest(map[string]interface{}{
+			"operation": "inspect_tools",
+			"name":      "github",
+		}))
+		require.NoError(t, err)
+		require.False(t, result.IsError)
+		return result
+	}
+
+	payload := decodeToolJSON(t, inspect())
+	assert.Equal(t, neverScannedHint, payload["scan_status"])
+
+	fake.setScanResult("github",
+		&scanner.ScanJob{ID: "job-5", ServerName: "github", Status: scanner.ScanJobStatusCompleted},
+		settledSummary("dangerous", 90))
+	payload = decodeToolJSON(t, inspect())
+	assert.Contains(t, payload["scan_status"], "dangerous")
+}
+
+// TestQuarantineSecurity_InspectTools_EmptyStateCarriesScanStatus covers the
+// no-records early return, which is plain text rather than JSON.
+func TestQuarantineSecurity_InspectTools_EmptyStateCarriesScanStatus(t *testing.T) {
+	proxy, _ := scanTestProxy(t, &config.ServerConfig{Name: "github", Enabled: true})
+
+	result, err := proxy.handleQuarantineSecurity(context.Background(), quarantineRequest(map[string]interface{}{
+		"operation": "inspect_tools",
+		"name":      "github",
+	}))
+	require.NoError(t, err)
+	require.False(t, result.IsError)
+	assert.Contains(t, result.Content[0].(mcp.TextContent).Text, neverScannedHint)
+}
+
+// TestQuarantineSecurity_ScanOps_WithoutScannerService — a proxy with no
+// scanner (stdio-only mode) must explain that, not crash.
+func TestQuarantineSecurity_ScanOps_WithoutScannerService(t *testing.T) {
+	proxy, _ := createTestProxyWithRuntime(t, []*config.ServerConfig{{Name: "github", Enabled: true}})
+
+	for _, op := range []string{"scan_server", "get_scan_report"} {
+		result, err := proxy.handleQuarantineSecurity(context.Background(), quarantineRequest(map[string]interface{}{
+			"operation": op,
+			"name":      "github",
+		}))
+		require.NoError(t, err)
+		require.True(t, result.IsError, "%s must report the missing scanner", op)
+		assert.Contains(t, result.Content[0].(mcp.TextContent).Text, "unavailable")
+	}
+}
+
+// TestQuarantineSecurity_QuarantineServerOperationName — the enum advertises
+// "quarantine_server"; the dispatch used to accept only the old "quarantine"
+// spelling, so the advertised name returned "Unknown quarantine operation".
+func TestQuarantineSecurity_QuarantineServerOperationName(t *testing.T) {
+	proxy, _ := scanTestProxy(t, &config.ServerConfig{Name: "github", Enabled: true})
+
+	result, err := proxy.handleQuarantineSecurity(context.Background(), quarantineRequest(map[string]interface{}{
+		"operation": "quarantine_server",
+		"name":      "github",
+	}))
+	require.NoError(t, err)
+	assert.NotContains(t, result.Content[0].(mcp.TextContent).Text, "Unknown quarantine operation")
+}
diff --git a/internal/server/scan_admission_test.go b/internal/server/scan_admission_test.go
index 4250f3637..0f7d6566b 100644
--- a/internal/server/scan_admission_test.go
+++ b/internal/server/scan_admission_test.go
@@ -36,6 +36,20 @@ type fakeSecurityScanner struct {
 	// startScanErr for the servers it names.
 	startScanErrByServer map[string]error
 
+	// Scan-surface fixtures (quarantine_security scan_server /
+	// get_scan_report). jobs/reports are keyed by server name; startScanErr
+	// and reportErr let a test drive the failure branches.
+	jobs map[string]*scanner.ScanJob
+	// passJobs pins a job for one specific (server, pass) pair, so a test can
+	// make the ACTIVE job differ from the Pass-1 job — the shape produced when
+	// a completed Pass 1 auto-starts the Pass-2 deep audit.
+	passJobs  map[passKey]*scanner.ScanJob
+	reports   map[string]*scanner.AggregatedReport
+	reportErr error
+	// onStartScan runs inside StartScan, so a test can make the scan "settle"
+	// (publish a completed job + summary) exactly when it is triggered.
+	onStartScan func(serverName string)
+
 	approveCalls   []string
 	startScanCalls []string
 	// startScanTries records EVERY StartScan entry, including the ones that
@@ -48,9 +62,35 @@ func newFakeSecurityScanner() *fakeSecurityScanner {
 		summaries:   map[string]*scanner.ScanSummary{},
 		hasBaseline: map[string]bool{},
 		scanResult:  map[string]*scanner.ScanSummary{},
+		jobs:        map[string]*scanner.ScanJob{},
+		passJobs:    map[passKey]*scanner.ScanJob{},
+		reports:     map[string]*scanner.AggregatedReport{},
 	}
 }
 
+// passKey addresses one (server, scan pass) pair in the fake.
+type passKey struct {
+	server string
+	pass   int
+}
+
+// setPassJob pins the job a per-pass lookup resolves to, independently of the
+// job the generic status lookup returns.
+func (f *fakeSecurityScanner) setPassJob(serverName string, pass int, job *scanner.ScanJob) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	f.passJobs[passKey{server: serverName, pass: pass}] = job
+}
+
+// setScanResult publishes a settled scan for a server: the job the status poll
+// sees and the summary the verdict is read from.
+func (f *fakeSecurityScanner) setScanResult(serverName string, job *scanner.ScanJob, summary *scanner.ScanSummary) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	f.jobs[serverName] = job
+	f.summaries[serverName] = summary
+}
+
 func (f *fakeSecurityScanner) GetScanSummary(_ context.Context, serverName string) *scanner.ScanSummary {
 	f.mu.Lock()
 	defer f.mu.Unlock()
@@ -69,20 +109,78 @@ func (f *fakeSecurityScanner) ApproveServer(_ context.Context, serverName string
 
 func (f *fakeSecurityScanner) StartScan(_ context.Context, serverName string, _ bool, _ []string, _ string) (*scanner.ScanJob, error) {
 	f.mu.Lock()
-	defer f.mu.Unlock()
 	f.startScanTries = append(f.startScanTries, serverName)
-	if err, ok := f.startScanErrByServer[serverName]; ok {
+	err, targeted := f.startScanErrByServer[serverName]
+	if !targeted {
+		err = f.startScanErr
+	}
+	if err == nil {
+		f.startScanCalls = append(f.startScanCalls, serverName)
+		// Mirror the real service: a scan that ran leaves a readable summary behind.
+		if result, ok := f.scanResult[serverName]; ok {
+			f.summaries[serverName] = result
+		}
+	}
+	hook := f.onStartScan
+	f.mu.Unlock()
+
+	// The hook may publish the settled job, so read it back afterwards. It runs
+	// on the failure path too, so a test can observe a rejected start.
+	if hook != nil {
+		hook(serverName)
+	}
+	if err != nil {
 		return nil, err
 	}
-	if f.startScanErr != nil {
-		return nil, f.startScanErr
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	// StartScan starts Pass 1 and hands back THAT job, so prefer a pinned
+	// Pass-1 job when a test has made the passes differ. Tests that never pin a
+	// job get a nil job back, matching the fire-and-forget admission paths.
+	if job, ok := f.passJobs[passKey{server: serverName, pass: scanner.ScanPassSecurityScan}]; ok && job != nil {
+		return job, nil
+	}
+	return f.jobs[serverName], nil
+}
+
+func (f *fakeSecurityScanner) GetScanStatus(_ context.Context, serverName string) (*scanner.ScanJob, error) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	job, ok := f.jobs[serverName]
+	if !ok {
+		return nil, errors.New("no scan job")
+	}
+	return job, nil
+}
+
+// GetScanStatusByPass mirrors the service: a per-pass lookup. The fake keys one
+// job per server, so pass 1 resolves to it and any other pass falls through to
+// the same job — enough to exercise the "poll Pass 1, not whatever is active"
+// contract, with passJobs available when a test needs the two to differ.
+func (f *fakeSecurityScanner) GetScanStatusByPass(_ context.Context, serverName string, pass int) (*scanner.ScanJob, error) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	if job, ok := f.passJobs[passKey{server: serverName, pass: pass}]; ok {
+		return job, nil
+	}
+	job, ok := f.jobs[serverName]
+	if !ok {
+		return nil, errors.New("no scan job")
+	}
+	return job, nil
+}
+
+func (f *fakeSecurityScanner) GetScanReport(_ context.Context, serverName string) (*scanner.AggregatedReport, error) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	if f.reportErr != nil {
+		return nil, f.reportErr
 	}
-	f.startScanCalls = append(f.startScanCalls, serverName)
-	// Mirror the real service: a scan that ran leaves a readable summary behind.
-	if result, ok := f.scanResult[serverName]; ok {
-		f.summaries[serverName] = result
+	report, ok := f.reports[serverName]
+	if !ok {
+		return nil, errors.New("no scan found")
 	}
-	return nil, nil
+	return report, nil
 }
 
 func (f *fakeSecurityScanner) HasApprovalBaseline(serverName string) bool {
diff --git a/internal/server/server.go b/internal/server/server.go
index 4fd7310a5..ce894d491 100644
--- a/internal/server/server.go
+++ b/internal/server/server.go
@@ -62,6 +62,16 @@ type securityScannerService interface {
 	GetScanSummary(ctx context.Context, serverName string) *scanner.ScanSummary
 	ApproveServer(ctx context.Context, serverName string, force bool, approvedBy string) error
 	StartScan(ctx context.Context, serverName string, dryRun bool, scannerIDs []string, sourceDir string) (*scanner.ScanJob, error)
+	// GetScanStatus / GetScanReport back the quarantine_security scan
+	// operations (scan_server / get_scan_report): an agent that just triggered
+	// a scan needs the job's terminal state and the verdict that came out of it.
+	GetScanStatus(ctx context.Context, serverName string) (*scanner.ScanJob, error)
+	// GetScanStatusByPass resolves ONE pass's job. scan_server must poll Pass 1
+	// specifically: GetScanStatus answers with whatever job is active for the
+	// server, and a completed Pass 1 auto-starts the Pass-2 deep audit, which
+	// would otherwise mask the baseline verdict the caller is waiting for.
+	GetScanStatusByPass(ctx context.Context, serverName string, pass int) (*scanner.ScanJob, error)
+	GetScanReport(ctx context.Context, serverName string) (*scanner.AggregatedReport, error)
 	HasApprovalBaseline(serverName string) bool
 	ApplySecurityConfig(sec *config.SecurityConfig)
 	SetIsolationMode(mode string)
diff --git a/internal/server/socket_e2e_test.go b/internal/server/socket_e2e_test.go
index afa9714c3..b7e0928e4 100644
--- a/internal/server/socket_e2e_test.go
+++ b/internal/server/socket_e2e_test.go
@@ -403,11 +403,13 @@ func TestE2E_SocketPermissions(t *testing.T) {
 
 	socketPath := filepath.Join(tmpDir, "mcpproxy.sock")
 
-	// Wait for socket file to be created (HTTP server starts asynchronously)
+	// Wait for the socket file to be created AND hardened (HTTP server starts
+	// asynchronously, and net.Listen creates the file umask-default before the
+	// listener chmods it to 0600 — stat'ing inside that window sees 0755)
 	require.Eventually(t, func() bool {
-		_, err := os.Stat(socketPath)
-		return err == nil
-	}, 2*time.Second, 100*time.Millisecond, "Socket file should be created")
+		info, err := os.Stat(socketPath)
+		return err == nil && info.Mode().Perm() == 0600
+	}, 2*time.Second, 100*time.Millisecond, "Socket file should be created with 0600 permissions")
 
 	// Check socket file permissions
 	info, err := os.Stat(socketPath)
diff --git a/internal/server/testdata/toolslist_goldens/code_execution_mode.json b/internal/server/testdata/toolslist_goldens/code_execution_mode.json
index b9f6af6ee..29e080fd2 100644
--- a/internal/server/testdata/toolslist_goldens/code_execution_mode.json
+++ b/internal/server/testdata/toolslist_goldens/code_execution_mode.json
@@ -48,15 +48,15 @@
       "idempotentHint": false,
       "openWorldHint": false
     },
-    "description": "Security quarantine management for MCP servers and tools. Review and manage quarantined servers and tools to prevent Tool Poisoning Attacks (TPAs). Supports server-level quarantine and tool-level approval for individual tool description/schema changes. NOTE: Unquarantining servers is only available through manual config editing or system tray UI for security.",
+    "description": "Security quarantine management AND TPA scanning for MCP servers and tools. Review and manage quarantined servers and tools to prevent Tool Poisoning Attacks (TPAs), and scan a server for them: 'scan_server' runs the always-on offline baseline scan (in-process, no Docker required) and 'get_scan_report' returns the latest verdict and findings. Every listing/inspection response also carries a one-line scan status, so an unscanned server is visible as unscanned. Supports server-level quarantine and tool-level approval for individual tool description/schema changes. NOTE: Unquarantining servers is only available through manual config editing or system tray UI for security.",
     "inputSchema": {
       "properties": {
         "name": {
-          "description": "Server name (required for inspect_quarantined, quarantine_server, inspect_tools, approve_tool, approve_all_tools, block_tool, block_all_tools, approve_prompt, approve_all_prompts)",
+          "description": "Server name (required for inspect_quarantined, quarantine_server, inspect_tools, approve_tool, approve_all_tools, block_tool, block_all_tools, approve_prompt, approve_all_prompts, scan_server, get_scan_report)",
           "type": "string"
         },
         "operation": {
-          "description": "Security operation: list_quarantined, inspect_quarantined, quarantine_server, inspect_tools, approve_tool, approve_all_tools, block_tool, block_all_tools, enable_tool, disable_tool, inspect_prompts, approve_prompt, approve_all_prompts. 'block_tool'/'block_all_tools' atomically approve AND disable a tool (acknowledge it but keep it hidden) — all-or-nothing so a tool is never left approved+enabled. The prompt operations (spec 100) manage aggregated upstream prompts held by the metadata rug-pull baseline: a prompt whose advertised metadata changed since approval is withheld from prompts/list until approved.",
+          "description": "Security operation: list_quarantined, inspect_quarantined, quarantine_server, inspect_tools, approve_tool, approve_all_tools, block_tool, block_all_tools, enable_tool, disable_tool, inspect_prompts, approve_prompt, approve_all_prompts, scan_server, get_scan_report. 'block_tool'/'block_all_tools' atomically approve AND disable a tool (acknowledge it but keep it hidden) — all-or-nothing so a tool is never left approved+enabled. The prompt operations (spec 100) manage aggregated upstream prompts held by the metadata rug-pull baseline: a prompt whose advertised metadata changed since approval is withheld from prompts/list until approved. 'scan_server' starts the offline TPA baseline scan for one server (no Docker needed) and returns the verdict once it settles, or a job id to poll; 'get_scan_report' returns that server's latest verdict, counts and findings.",
           "enum": [
             "list_quarantined",
             "inspect_quarantined",
@@ -70,7 +70,9 @@
             "disable_tool",
             "inspect_prompts",
             "approve_prompt",
-            "approve_all_prompts"
+            "approve_all_prompts",
+            "scan_server",
+            "get_scan_report"
           ],
           "type": "string"
         },
diff --git a/internal/server/testdata/toolslist_goldens/default_server.json b/internal/server/testdata/toolslist_goldens/default_server.json
index a4f4680c8..b76af5443 100644
--- a/internal/server/testdata/toolslist_goldens/default_server.json
+++ b/internal/server/testdata/toolslist_goldens/default_server.json
@@ -188,15 +188,15 @@
       "idempotentHint": false,
       "openWorldHint": false
     },
-    "description": "Security quarantine management for MCP servers and tools. Review and manage quarantined servers and tools to prevent Tool Poisoning Attacks (TPAs). Supports server-level quarantine and tool-level approval for individual tool description/schema changes. NOTE: Unquarantining servers is only available through manual config editing or system tray UI for security.",
+    "description": "Security quarantine management AND TPA scanning for MCP servers and tools. Review and manage quarantined servers and tools to prevent Tool Poisoning Attacks (TPAs), and scan a server for them: 'scan_server' runs the always-on offline baseline scan (in-process, no Docker required) and 'get_scan_report' returns the latest verdict and findings. Every listing/inspection response also carries a one-line scan status, so an unscanned server is visible as unscanned. Supports server-level quarantine and tool-level approval for individual tool description/schema changes. NOTE: Unquarantining servers is only available through manual config editing or system tray UI for security.",
     "inputSchema": {
       "properties": {
         "name": {
-          "description": "Server name (required for inspect_quarantined, quarantine_server, inspect_tools, approve_tool, approve_all_tools, block_tool, block_all_tools, approve_prompt, approve_all_prompts)",
+          "description": "Server name (required for inspect_quarantined, quarantine_server, inspect_tools, approve_tool, approve_all_tools, block_tool, block_all_tools, approve_prompt, approve_all_prompts, scan_server, get_scan_report)",
           "type": "string"
         },
         "operation": {
-          "description": "Security operation: list_quarantined, inspect_quarantined, quarantine_server, inspect_tools, approve_tool, approve_all_tools, block_tool, block_all_tools, enable_tool, disable_tool, inspect_prompts, approve_prompt, approve_all_prompts. 'block_tool'/'block_all_tools' atomically approve AND disable a tool (acknowledge it but keep it hidden) — all-or-nothing so a tool is never left approved+enabled. The prompt operations (spec 100) manage aggregated upstream prompts held by the metadata rug-pull baseline: a prompt whose advertised metadata changed since approval is withheld from prompts/list until approved.",
+          "description": "Security operation: list_quarantined, inspect_quarantined, quarantine_server, inspect_tools, approve_tool, approve_all_tools, block_tool, block_all_tools, enable_tool, disable_tool, inspect_prompts, approve_prompt, approve_all_prompts, scan_server, get_scan_report. 'block_tool'/'block_all_tools' atomically approve AND disable a tool (acknowledge it but keep it hidden) — all-or-nothing so a tool is never left approved+enabled. The prompt operations (spec 100) manage aggregated upstream prompts held by the metadata rug-pull baseline: a prompt whose advertised metadata changed since approval is withheld from prompts/list until approved. 'scan_server' starts the offline TPA baseline scan for one server (no Docker needed) and returns the verdict once it settles, or a job id to poll; 'get_scan_report' returns that server's latest verdict, counts and findings.",
           "enum": [
             "list_quarantined",
             "inspect_quarantined",
@@ -210,7 +210,9 @@
             "disable_tool",
             "inspect_prompts",
             "approve_prompt",
-            "approve_all_prompts"
+            "approve_all_prompts",
+            "scan_server",
+            "get_scan_report"
           ],
           "type": "string"
         },
diff --git a/internal/server/testdata/toolslist_goldens/pre099/code_execution_mode.json b/internal/server/testdata/toolslist_goldens/pre099/code_execution_mode.json
new file mode 100644
index 000000000..b9f6af6ee
--- /dev/null
+++ b/internal/server/testdata/toolslist_goldens/pre099/code_execution_mode.json
@@ -0,0 +1,304 @@
+{
+  "code_execution": {
+    "annotations": {
+      "title": "Code Execution (Disabled)",
+      "readOnlyHint": true,
+      "destructiveHint": false,
+      "idempotentHint": false,
+      "openWorldHint": false
+    },
+    "description": "Code execution is currently disabled. Enable it by setting \"enable_code_execution\": true in your mcpproxy config.",
+    "inputSchema": {
+      "properties": {
+        "code": {
+          "description": "JavaScript source code to execute.",
+          "type": "string"
+        },
+        "script": {
+          "description": "Name of a stored script to execute.",
+          "type": "string"
+        }
+      },
+      "required": [],
+      "type": "object"
+    },
+    "name": "code_execution"
+  },
+  "list_registries": {
+    "annotations": {
+      "title": "List Registries",
+      "readOnlyHint": true,
+      "destructiveHint": false,
+      "idempotentHint": false,
+      "openWorldHint": false
+    },
+    "description": "📋 List all available MCP registries. Use this FIRST to discover which registries you can search with the 'search_servers' tool. Each registry contains different collections of MCP servers that can be added as upstreams.",
+    "inputSchema": {
+      "properties": {},
+      "required": [],
+      "type": "object"
+    },
+    "name": "list_registries"
+  },
+  "quarantine_security": {
+    "annotations": {
+      "title": "Quarantine Security",
+      "readOnlyHint": false,
+      "destructiveHint": true,
+      "idempotentHint": false,
+      "openWorldHint": false
+    },
+    "description": "Security quarantine management for MCP servers and tools. Review and manage quarantined servers and tools to prevent Tool Poisoning Attacks (TPAs). Supports server-level quarantine and tool-level approval for individual tool description/schema changes. NOTE: Unquarantining servers is only available through manual config editing or system tray UI for security.",
+    "inputSchema": {
+      "properties": {
+        "name": {
+          "description": "Server name (required for inspect_quarantined, quarantine_server, inspect_tools, approve_tool, approve_all_tools, block_tool, block_all_tools, approve_prompt, approve_all_prompts)",
+          "type": "string"
+        },
+        "operation": {
+          "description": "Security operation: list_quarantined, inspect_quarantined, quarantine_server, inspect_tools, approve_tool, approve_all_tools, block_tool, block_all_tools, enable_tool, disable_tool, inspect_prompts, approve_prompt, approve_all_prompts. 'block_tool'/'block_all_tools' atomically approve AND disable a tool (acknowledge it but keep it hidden) — all-or-nothing so a tool is never left approved+enabled. The prompt operations (spec 100) manage aggregated upstream prompts held by the metadata rug-pull baseline: a prompt whose advertised metadata changed since approval is withheld from prompts/list until approved.",
+          "enum": [
+            "list_quarantined",
+            "inspect_quarantined",
+            "quarantine_server",
+            "inspect_tools",
+            "approve_tool",
+            "approve_all_tools",
+            "block_tool",
+            "block_all_tools",
+            "enable_tool",
+            "disable_tool",
+            "inspect_prompts",
+            "approve_prompt",
+            "approve_all_prompts"
+          ],
+          "type": "string"
+        },
+        "prompt_name": {
+          "description": "Prompt name (required for approve_prompt; spec 100)",
+          "type": "string"
+        },
+        "tool_name": {
+          "description": "Tool name (required for approve_tool and block_tool operations)",
+          "type": "string"
+        }
+      },
+      "required": [
+        "operation"
+      ],
+      "type": "object"
+    },
+    "name": "quarantine_security"
+  },
+  "retrieve_tools": {
+    "annotations": {
+      "title": "Retrieve Tools",
+      "readOnlyHint": true,
+      "destructiveHint": false,
+      "idempotentHint": false,
+      "openWorldHint": false
+    },
+    "description": "Search and discover available upstream tools using BM25 full-text search. Use this to find tools, then use the `code_execution` tool to call them via `call_tool(serverName, toolName, args)` in JavaScript. Do NOT use call_tool_read/write/destructive — they are not available in this mode. Use natural language to describe what you want to accomplish. Response includes a structured `session_risk` object (level, lethal_trifecta, has_open_world_tools, has_destructive_tools, has_write_tools). ANNOTATION FILTERS: read_only_only, exclude_destructive and exclude_open_world self-restrict discovery. When they withhold tools that matched your query, the response carries a 'filter_diagnostics' block with per-filter counts (split into missing upstream annotations vs. explicitly unsafe ones) and one suggestion; it is absent when nothing was withheld. Filter diagnostics describe this call's candidate window, not the whole catalog.",
+    "inputSchema": {
+      "properties": {
+        "exclude_destructive": {
+          "description": "Exclude tools with destructiveHint=true or unset (MCP default is destructive). Use to avoid destructive operations.",
+          "type": "boolean"
+        },
+        "exclude_open_world": {
+          "description": "Exclude tools with openWorldHint=true or unset (MCP default is open-world). Use to restrict to local/sandboxed tools.",
+          "type": "boolean"
+        },
+        "include_session_risk_warning": {
+          "description": "Include the prose 'warning' string in session_risk when the lethal trifecta is detected (default: false; structured fields are always returned). Server-side default can be flipped via the 'tool_response_session_risk_warning' config flag.",
+          "type": "boolean"
+        },
+        "limit": {
+          "description": "Maximum number of tools to return (default: configured tools_limit, max: 100)",
+          "type": "number"
+        },
+        "query": {
+          "description": "Natural language description of what you want to accomplish.",
+          "type": "string"
+        },
+        "read_only_only": {
+          "description": "Only return tools with readOnlyHint=true. Use to self-restrict to safe read operations.",
+          "type": "boolean"
+        }
+      },
+      "required": [
+        "query"
+      ],
+      "type": "object"
+    },
+    "name": "retrieve_tools"
+  },
+  "search_servers": {
+    "annotations": {
+      "title": "Search Servers",
+      "readOnlyHint": true,
+      "destructiveHint": false,
+      "idempotentHint": false,
+      "openWorldHint": true
+    },
+    "description": "🔍 Discover MCP servers from known registries with repository type detection. Search and filter servers from embedded registry list to find new MCP servers that can be added as upstreams. Features npm/PyPI package detection for enhanced install commands. WORKFLOW: 1) Call 'list_registries' first to see available registries, 2) Use this tool with a registry ID to search servers. Results include server URLs and repository information ready for direct use with upstream_servers add command.",
+    "inputSchema": {
+      "properties": {
+        "limit": {
+          "description": "Maximum number of results to return (default: 10, max: 50)",
+          "type": "number"
+        },
+        "registry": {
+          "description": "Registry ID or name to search (e.g., 'smithery', 'mcprun', 'pulse'). Use 'list_registries' tool first to see available registries.",
+          "type": "string"
+        },
+        "search": {
+          "description": "Search term to filter servers by name or description (case-insensitive)",
+          "type": "string"
+        },
+        "tag": {
+          "description": "Filter servers by tag/category (if supported by registry)",
+          "type": "string"
+        }
+      },
+      "required": [
+        "registry"
+      ],
+      "type": "object"
+    },
+    "name": "search_servers"
+  },
+  "set_profile": {
+    "annotations": {
+      "title": "Set Profile",
+      "readOnlyHint": true,
+      "destructiveHint": false,
+      "idempotentHint": false,
+      "openWorldHint": false
+    },
+    "description": "Switch the active profile for THIS session. A profile scopes tool discovery (retrieve_tools) and tool calls to a named subset of upstream servers — useful to focus an agent on one task domain (e.g. 'research', 'deploy'). The selection persists for the lifetime of the current MCP session and applies to subsequent retrieve_tools / call_tool_* / code_execution calls on the base /mcp endpoint without re-indexing. Pass an empty string to clear the selection and go back to all servers. Note: an explicit /mcp/p/\u003cslug\u003e URL still overrides the session profile for that request, and a profile-pinned agent token cannot switch away from its pinned profile.",
+    "inputSchema": {
+      "properties": {
+        "profile": {
+          "description": "Profile slug to activate for this session (e.g. 'research'). Pass \"\" (empty) to clear the active profile and return to all servers.",
+          "type": "string"
+        }
+      },
+      "required": [],
+      "type": "object"
+    },
+    "name": "set_profile"
+  },
+  "upstream_servers": {
+    "annotations": {
+      "title": "Upstream Servers",
+      "readOnlyHint": false,
+      "destructiveHint": true,
+      "idempotentHint": false,
+      "openWorldHint": false
+    },
+    "description": "Manage upstream MCP servers - add, remove, update, and list servers. Includes Docker isolation configuration and connection status monitoring. SECURITY: Newly added servers are automatically quarantined to prevent Tool Poisoning Attacks (TPAs). Use 'quarantine_security' tool to review and manage quarantined servers. NOTE: Unquarantining servers is only available through manual config editing or system tray UI for security.\n\nDocker Isolation: Use 'isolation_json' parameter to configure per-server Docker images, CPU/memory limits, and network isolation. Example: {\"enabled\": true, \"image\": \"node:20\", \"network_mode\": \"bridge\"}.\n\nSMART PATCHING (update/patch): Uses deep merge - only specify fields you want to change. Omitted fields are PRESERVED, not removed. Examples:\n- Enable server: {\"operation\": \"patch\", \"name\": \"my-server\", \"enabled\": true} - only enabled changes\n- Enable isolation: {\"operation\": \"patch\", \"name\": \"my-server\", \"isolation_json\": \"{\\\"enabled\\\": true}\"} - enables isolation with defaults\n- Update image: {\"operation\": \"patch\", \"name\": \"my-server\", \"isolation_json\": \"{\\\"image\\\": \\\"python:3.12\\\"}\"} - other isolation fields preserved\n- Add env var: env_json merges with existing vars\n- Replace args: args_json replaces entirely (arrays not merged)\n- Remove field: use 'null' (e.g., isolation_json: \"null\" removes isolation)",
+    "inputSchema": {
+      "properties": {
+        "args_json": {
+          "description": "Command arguments for stdio servers as a JSON array of strings (e.g., '[\"mcp-server-sqlite\", \"--db-path\", \"/path/to/db\"]'). For update/patch: REPLACES all existing args (arrays are not merged).",
+          "type": "string"
+        },
+        "command": {
+          "description": "Command to run for stdio servers (e.g., 'uvx', 'python')",
+          "type": "string"
+        },
+        "enabled": {
+          "description": "Whether server should be enabled (default: true)",
+          "type": "boolean"
+        },
+        "env_json": {
+          "description": "Environment variables for stdio servers as JSON object (e.g., '{\"API_KEY\": \"value\"}'). For update/patch: MERGES with existing vars (new keys added, existing keys updated).",
+          "type": "string"
+        },
+        "expose_prompts": {
+          "description": "Per-server prompt-aggregation override (F9): true = include this server's MCP prompts in mcpproxy's aggregated prompts/list; false = exclude them regardless of capability. Omit to leave unchanged (patch) / inherit the default (aggregate if advertised). Only meaningful when aggregate_upstream_prompts is enabled globally. Used with add/update/patch.",
+          "type": "boolean"
+        },
+        "headers_json": {
+          "description": "HTTP headers for authentication as JSON object (e.g., '{\"Authorization\": \"Bearer token\"}'). For update/patch: MERGES with existing headers (new keys added, existing keys updated).",
+          "type": "string"
+        },
+        "id": {
+          "description": "Server id within the registry - required for add_from_registry.",
+          "type": "string"
+        },
+        "init_timeout": {
+          "description": "Per-server MCP `initialize` handshake deadline as a duration string (e.g. '120s', '3m'). Raise this for upstreams that do legitimate first-run warmup (cache/index build) before responding to `initialize`, so they are not killed mid-startup. Unset → global default (30s). Bounds: 1s–30m. Used with add/update/patch.",
+          "type": "string"
+        },
+        "isolation_json": {
+          "description": "Docker isolation config as JSON object. MERGES with existing settings - only provided fields change. Use 'null' to remove isolation entirely. Example: '{\"image\": \"python:3.12\"}' updates only the image.",
+          "type": "string"
+        },
+        "lines": {
+          "description": "Number of lines to tail from server log (default: 50, max: 500) - used with tail_log operation",
+          "type": "number"
+        },
+        "name": {
+          "description": "Server name (required for add/remove/update/patch/tail_log operations; optional name override for add_from_registry)",
+          "type": "string"
+        },
+        "oauth_json": {
+          "description": "OAuth config as JSON object. MERGES with existing settings. Use 'null' to remove OAuth entirely. Fields: client_id, client_secret, scopes (array - replaces).",
+          "type": "string"
+        },
+        "operation": {
+          "description": "Operation: list, add, remove, update, patch, tail_log, add_from_registry, enable, disable, restart, refresh. 'update' and 'patch' use smart merge - only specified fields change, others preserved. 'add_from_registry' adds an upstream from a registry reference (registry+id) so you need not hand-construct command/args/url - the server re-derives the runnable config and quarantines it. 'refresh' re-discovers and re-indexes a server's tools without changing any security state - use it to make just-approved tools searchable immediately. For quarantine operations, use the 'quarantine_security' tool.",
+          "enum": [
+            "list",
+            "add",
+            "remove",
+            "update",
+            "patch",
+            "tail_log",
+            "add_from_registry",
+            "enable",
+            "disable",
+            "restart",
+            "refresh"
+          ],
+          "type": "string"
+        },
+        "protocol": {
+          "description": "Transport protocol: stdio, http, sse, streamable-http, auto (default: auto-detect)",
+          "enum": [
+            "stdio",
+            "http",
+            "sse",
+            "streamable-http",
+            "auto"
+          ],
+          "type": "string"
+        },
+        "registry": {
+          "description": "Registry id to add from (e.g. 'pulse') - required for add_from_registry. Use the 'list_registries'/'search_servers' tools to discover registries and server ids.",
+          "type": "string"
+        },
+        "trust_mode": {
+          "description": "Per-server trust tier governing new-server admission AND tool-change approval (spec 086): 'auto' = approve without scanning; 'scan' = auto-approve only when the fast offline TPA scan is green, else hold for review; 'manual' = human reviews every change. Empty → manual (secure default). Used with add/update/patch.",
+          "enum": [
+            "auto",
+            "scan",
+            "manual"
+          ],
+          "type": "string"
+        },
+        "url": {
+          "description": "Server URL for HTTP/SSE servers (e.g., 'http://localhost:3001')",
+          "type": "string"
+        }
+      },
+      "required": [
+        "operation"
+      ],
+      "type": "object"
+    },
+    "name": "upstream_servers"
+  }
+}
diff --git a/internal/server/testdata/toolslist_goldens/retrieve_tools_mode.json b/internal/server/testdata/toolslist_goldens/retrieve_tools_mode.json
index d0b2dbd4e..7eef750e7 100644
--- a/internal/server/testdata/toolslist_goldens/retrieve_tools_mode.json
+++ b/internal/server/testdata/toolslist_goldens/retrieve_tools_mode.json
@@ -213,15 +213,15 @@
       "idempotentHint": false,
       "openWorldHint": false
     },
-    "description": "Security quarantine management for MCP servers and tools. Review and manage quarantined servers and tools to prevent Tool Poisoning Attacks (TPAs). Supports server-level quarantine and tool-level approval for individual tool description/schema changes. NOTE: Unquarantining servers is only available through manual config editing or system tray UI for security.",
+    "description": "Security quarantine management AND TPA scanning for MCP servers and tools. Review and manage quarantined servers and tools to prevent Tool Poisoning Attacks (TPAs), and scan a server for them: 'scan_server' runs the always-on offline baseline scan (in-process, no Docker required) and 'get_scan_report' returns the latest verdict and findings. Every listing/inspection response also carries a one-line scan status, so an unscanned server is visible as unscanned. Supports server-level quarantine and tool-level approval for individual tool description/schema changes. NOTE: Unquarantining servers is only available through manual config editing or system tray UI for security.",
     "inputSchema": {
       "properties": {
         "name": {
-          "description": "Server name (required for inspect_quarantined, quarantine_server, inspect_tools, approve_tool, approve_all_tools, block_tool, block_all_tools, approve_prompt, approve_all_prompts)",
+          "description": "Server name (required for inspect_quarantined, quarantine_server, inspect_tools, approve_tool, approve_all_tools, block_tool, block_all_tools, approve_prompt, approve_all_prompts, scan_server, get_scan_report)",
           "type": "string"
         },
         "operation": {
-          "description": "Security operation: list_quarantined, inspect_quarantined, quarantine_server, inspect_tools, approve_tool, approve_all_tools, block_tool, block_all_tools, enable_tool, disable_tool, inspect_prompts, approve_prompt, approve_all_prompts. 'block_tool'/'block_all_tools' atomically approve AND disable a tool (acknowledge it but keep it hidden) — all-or-nothing so a tool is never left approved+enabled. The prompt operations (spec 100) manage aggregated upstream prompts held by the metadata rug-pull baseline: a prompt whose advertised metadata changed since approval is withheld from prompts/list until approved.",
+          "description": "Security operation: list_quarantined, inspect_quarantined, quarantine_server, inspect_tools, approve_tool, approve_all_tools, block_tool, block_all_tools, enable_tool, disable_tool, inspect_prompts, approve_prompt, approve_all_prompts, scan_server, get_scan_report. 'block_tool'/'block_all_tools' atomically approve AND disable a tool (acknowledge it but keep it hidden) — all-or-nothing so a tool is never left approved+enabled. The prompt operations (spec 100) manage aggregated upstream prompts held by the metadata rug-pull baseline: a prompt whose advertised metadata changed since approval is withheld from prompts/list until approved. 'scan_server' starts the offline TPA baseline scan for one server (no Docker needed) and returns the verdict once it settles, or a job id to poll; 'get_scan_report' returns that server's latest verdict, counts and findings.",
           "enum": [
             "list_quarantined",
             "inspect_quarantined",
@@ -235,7 +235,9 @@
             "disable_tool",
             "inspect_prompts",
             "approve_prompt",
-            "approve_all_prompts"
+            "approve_all_prompts",
+            "scan_server",
+            "get_scan_report"
           ],
           "type": "string"
         },
diff --git a/internal/server/toolslist_snapshot_test.go b/internal/server/toolslist_snapshot_test.go
index 151fdd88e..b9a2e2baa 100644
--- a/internal/server/toolslist_snapshot_test.go
+++ b/internal/server/toolslist_snapshot_test.go
@@ -33,15 +33,25 @@ import (
 //     DELIBERATELY, once, so the new definition — including its prose — is
 //     pinned byte-for-byte and a later edit shows up as a reviewable diff
 //     rather than drifting silently under the token budget.
-//  2. The regenerated goldens differ from the frozen pre-099 capture
-//     (testdata/toolslist_goldens/pre099/) in EXACTLY one tool entry,
-//     describe_tool, on exactly those two surfaces. Every other tool, and the
-//     whole code_execution surface, is byte-equal — which is why that surface
-//     has no pre099 copy at all: its golden was never regenerated.
+//  2. The regenerated goldens differ from the frozen pre-feature capture
+//     (testdata/toolslist_goldens/pre099/) in EXACTLY the tool entries the
+//     shipped features were allowed to move — see toolsListAllowedDelta. Every
+//     other tool on every surface is byte-equal.
 //
 // A failure in (1) with no accompanying spec is a regression, not a golden to
 // refresh. A failure in (2) means a change reached further than it claimed.
 //
+// The enumerated delta currently covers two features:
+//
+//   - describe_tool (spec 099), on the two retrieve_tools-carrying surfaces;
+//   - quarantine_security, which gained the scan_server / get_scan_report
+//     operations so TPA scanning is reachable from the surface agents already
+//     use. It carries no new PARAMETER — the two operations reuse `name` — so
+//     the delta is the operation enum plus the prose that documents it. It is
+//     registered on all three surfaces, which is why code_execution_mode now
+//     has a frozen copy too (a byte-for-byte snapshot of its previous golden,
+//     which had never moved since the spec-098 capture).
+//
 // Surfaces covered (the three routing modes that expose a static, built-in
 // tool set):
 //
@@ -57,9 +67,10 @@ import (
 const (
 	toolsListGoldenDir = "toolslist_goldens"
 
-	// toolsListPre099Dir holds the FROZEN pre-099 capture of the two surfaces
-	// spec 099 was allowed to move. It is never regenerated: it is the baseline
-	// the enumerated delta is measured against.
+	// toolsListPre099Dir holds the FROZEN pre-feature capture of the surfaces
+	// an enumerated delta is measured against. It is never regenerated: it is
+	// the baseline, not a mirror of the current surface. (Named for spec 099,
+	// the first feature that needed it.)
 	toolsListPre099Dir = "pre099"
 
 	// toolsListGoldenWriteEnv, when set to a directory, makes this test WRITE
@@ -166,29 +177,35 @@ func TestToolsListSnapshot_MatchesMergeBaseGoldens(t *testing.T) {
 	}
 }
 
-// toolsListPre099Surfaces maps a surface to the tool entries spec 099 was
-// allowed to change on it (FR-014). A surface absent from this map may not move
-// at all — code_execution_mode is deliberately absent.
-var toolsListPre099Surfaces = map[string][]string{
-	"default_server":      {"describe_tool"},
-	"retrieve_tools_mode": {"describe_tool"},
+// toolsListAllowedDelta maps a surface to the tool entries the shipped features
+// were allowed to change on it, measured against the frozen pre-feature
+// capture. Every surface with a frozen copy appears here; adding a name to a
+// list is a deliberate, reviewable act.
+//
+//   - describe_tool        — spec 099 (FR-014), retrieve_tools surfaces only.
+//   - quarantine_security  — scan_server / get_scan_report operations, on every
+//     surface that registers the tool (all three).
+var toolsListAllowedDelta = map[string][]string{
+	"default_server":      {"describe_tool", "quarantine_security"},
+	"retrieve_tools_mode": {"describe_tool", "quarantine_security"},
+	"code_execution_mode": {"quarantine_security"},
 }
 
-// TestToolsListSnapshot_Spec099DeltaIsExactlyDescribeTool is the FR-014 gate:
-// the goldens moved, and this is the enumeration of how far.
-func TestToolsListSnapshot_Spec099DeltaIsExactlyDescribeTool(t *testing.T) {
-	for surface, allowed := range toolsListPre099Surfaces {
+// TestToolsListSnapshot_DeltaIsEnumerated is the FR-014 gate: the goldens
+// moved, and this is the enumeration of how far.
+func TestToolsListSnapshot_DeltaIsEnumerated(t *testing.T) {
+	for surface, allowed := range toolsListAllowedDelta {
 		surface, allowed := surface, allowed
 		t.Run(surface, func(t *testing.T) {
 			before := decodeToolsListGolden(t, filepath.Join("testdata", toolsListGoldenDir, toolsListPre099Dir, surface+".json"))
 			after := decodeToolsListGolden(t, toolsListGoldenPath(surface))
 
-			// The tool SET is unchanged: 099 adds parameters to an existing
-			// built-in, it does not register or retire one.
+			// The tool SET is unchanged: these features extend existing
+			// built-ins, they do not register or retire one.
 			assert.Equal(t, sortedToolNames(before), sortedToolNames(after),
-				"surface %s: spec 099 adds no tool and removes none", surface)
+				"surface %s: no tool may be added or removed", surface)
 
-			changed := make([]string, 0, 1)
+			changed := make([]string, 0, len(allowed))
 			for name, pre := range before {
 				post, ok := after[name]
 				if !ok {
@@ -199,15 +216,19 @@ func TestToolsListSnapshot_Spec099DeltaIsExactlyDescribeTool(t *testing.T) {
 				}
 			}
 			sort.Strings(changed)
-			assert.Equal(t, allowed, changed,
-				"surface %s: spec 099 may change describe_tool and nothing else", surface)
+			sortedAllowed := append([]string(nil), allowed...)
+			sort.Strings(sortedAllowed)
+			assert.Equal(t, sortedAllowed, changed,
+				"surface %s: only the enumerated tools may change", surface)
 		})
 	}
 
-	// The one surface that had no delta to enumerate: it must still match the
-	// spec-098 merge-base bytes, so it never needed a pre099 copy.
-	assert.NotContains(t, toolsListPre099Surfaces, "code_execution_mode",
-		"code_execution mode carries no describe_tool and must not move (FR-002/FR-014)")
+	// Every surface with a golden carries a frozen baseline to measure against:
+	// a surface silently dropping out of the map would stop being gated.
+	for _, surface := range toolsListGoldenSurfaces {
+		assert.Contains(t, toolsListAllowedDelta, surface,
+			"surface %s must be covered by the enumerated-delta gate", surface)
+	}
 }
 
 func decodeToolsListGolden(t *testing.T, path string) map[string]json.RawMessage {