About mcpcheckup
mcpcheckup is a scanner for remote MCP servers, intended for developers and operators assessing server behavior and configuration. It inventories protocol capabilities and content, then checks security heuristics, network settings, TLS, and license information.
Key features
- 01Protocol connectivity and handshake checks
- 02Tools, resources, and prompts inventory
- 03Security heuristic checks
- 04Network, TLS, and header checks
- 05License presence checks
Use cases
- 01Review a remote MCP server before adoption
- 02Inspect advertised tools and their schemas
- 03Identify transport and TLS configuration issues
MCP support
Accepts remote MCP server URLs using Streamable HTTP or SSE and exposes scanning tools through MCP. Its checks cover connectivity, advertised capabilities, content inventory, security heuristics, TLS, and licensing.
Configuration
Remote servers need no local install. Pick your client, then copy the config or install in one click.
https://mcpcheckup.xyz/api/mcpclaude mcp add --transport http fpetitit-mcpcheckup https://mcpcheckup.xyz/api/mcp{"mcpServers":{"fpetitit-mcpcheckup":{"type":"http","url":"https://mcpcheckup.xyz/api/mcp"}}}Open in Cursor{"servers":{"fpetitit-mcpcheckup":{"type":"http","url":"https://mcpcheckup.xyz/api/mcp"}}}Open in VS Code{"mcpServers":{"fpetitit-mcpcheckup":{"type":"http","url":"https://mcpcheckup.xyz/api/mcp"}}}{"mcpServers":{"fpetitit-mcpcheckup":{"serverUrl":"https://mcpcheckup.xyz/api/mcp"}}}Run commands in a terminal; paste JSON into the client’s MCP config and restart. Servers that need sign-in will prompt on first connect.
Tools
Details
From the project READMEmcpcheck
A webcheck.xyz-style scanner for remote MCP servers.
Enter the URL of an MCP server (Streamable HTTP or SSE transport) and get a dashboard of checks:
- Connectivity & Handshake — protocol negotiation, server info, advertised capabilities.
- Tools, Resources & Prompts — full inventory with schemas.
- Security Heuristics — prompt-injection-style wording in tool descriptions, tools that may expose sensitive capabilities (exec, filesystem, network), missing descriptions, plaintext transport.
- Network & TLS — certificate validity, HTTP security headers, CORS policy.
- License Information — presence of a LICENSE file or license mention in server instructions.
Development
npm install
npm run dev
Open http://localhost:3000 and paste an MCP server URL to scan.
Notes
- Only
http://andhttps://targets are accepted; scanning private/internal IP ranges orlocalhostis blocked to prevent SSRF. - Security checks are heuristic, not a substitute for a manual security review.
Comments
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.