Free MCP server validator

A deterministic, open-source command-line check of any public MCP server. No model, no account, no data sent to us. It runs the same read-only battery as our free scan and prints a report you can act on.

pipx run mcp-validator https://your-host.example/mcp
# or
uvx mcp-validator https://your-host.example/mcp

Source and issues: the mcp-validator repository on GitHub (link appears here when the first release is published).

What it checks

• Streamable-HTTP transport and the initialize handshake, protocol version, server identity
• tools/list: every input schema is valid JSON Schema, every tool has a usable description, names are client-safe, required matches properties
• Declared capabilities match what the server actually answers
• Auth discovery: a proper WWW-Authenticate challenge and protected-resource metadata when auth is required
• TLS certificate validity and expiry
• Credential-shaped strings in server responses
• Rate-limit headers and slow responses

What it never does

It never calls a tool, never reads a resource, never tries to bypass authentication, and never sends more than one request per second. The list of allowed JSON-RPC methods is a closed set in the code, and every request it makes is written to a hash-chained audit log you can inspect.

From validator to audit

The report maps each finding to the fixed remediation price on the offers page. If you want the tests the validator cannot run, that is the paid audit under a signed scope.