Free Tool

MCP Server Check

Paste the address of a remote MCP server. We check it from the outside, the way any MCP client first meets it, and show what we found and how to fix it. No signup, no token needed.

What it checks

  1. Requires a tokenDoes the server answer an unauthenticated initialize with a 401, or does it talk to anyone?
  2. Protected resource metadataDoes the 401 point clients to /.well-known/oauth-protected-resource, as the MCP spec requires?
  3. PKCE S256Does the authorization server publish metadata with S256 in code_challenge_methods_supported?
  4. Client registrationCan Claude, Cursor or ChatGPT connect without a manual setup step (Client ID Metadata Documents or dynamic registration)?
  5. Scope hintDoes the server say which scopes a client needs, so clients ask for the minimum?
  6. Tool descriptionsOn open servers: any text aimed at the model, hidden tags or invisible characters in tool descriptions?
  7. Input schemasOn open servers: are tool inputs typed and described?
  8. Tool annotationsOn open servers: do tools say whether they only read or can change things?
  9. Transport and HSTSCurrent Streamable HTTP transport, and HTTPS enforced on the endpoint.

The check is passive. It sends an MCP initialize request without credentials, reads the OAuth discovery documents, and, only if the server answers without a token, reads tools/list. It never calls a tool and never sends a token. Do not paste addresses that carry a key in the query string.

For agents

The same check is a plain JSON API. No key needed.

GET https://x1y1.co/api/mcp-check?url=example.com