diff --git a/src/static/manifest.ts b/src/static/manifest.ts
index f846c5f..3548f13 100644
--- a/src/static/manifest.ts
+++ b/src/static/manifest.ts
@@ -55,6 +55,12 @@ export function normalize(parsed: unknown, source: string): AuditTarget {
   const serverInfo = manifest.serverInfo ?? manifest.server ?? {};
   const declaredHttp = manifest.transport === "http";
 
+  if (manifest.tools !== undefined && !Array.isArray(manifest.tools)) {
+    throw new Error(
+      `Invalid manifest ${source}: tools must be an array`,
+    );
+  }
+
   return {
     transport: declaredHttp ? "http" : "static",
     source,
diff --git a/test/static.test.ts b/test/static.test.ts
index 18b593d..a05708a 100644
--- a/test/static.test.ts
+++ b/test/static.test.ts
@@ -36,6 +36,12 @@ describe("loadManifest", () => {
     expect(target.transport).toBe("static");
   });
 
+  it("rejects a manifest with non-array tools", () => {
+    expect(() => normalize({ tools: "MCP001" }, "bad.json")).toThrow(
+      /tools must be an array/i,
+    );
+  });
+
   it("rejects a missing manifest file", async () => {
     await expect(loadManifest(resolve(root, "does-not-exist.json"))).rejects.toBeTruthy();
   });