QAmcp

About

Find what is broken or unsafe in an MCP server before an agent does

Paste a server link on qamcp.dev, or run npx -y qamcp-cli https://your-server.example/mcp. For a server started from your project, use --stdio "<start command>". Add --header "Authorization: Bearer <key>" for API keys, --login for servers that need a sign-in, and --html or --json to save a report you can share or diff in CI. Things to know: it needs Node.js 20 or newer; --owner and --run-unlabeled exercise more tools, so keep them for a test copy, never live data; the site also has a setup.md you can hand to Claude Code, Cursor or Codex so the agent runs the test, explains the problems and fixes them with your OK.

Features

• 0 to 100 score with a visual map of failing tools
• Detects hidden instructions and invisible characters in tool descriptions
• Flags secrets and internal paths leaked in error messages
• Checks read-only and destructive labels against tool names
• Tests bad inputs, timeouts, login setup, resources and prompts
• Runs in the browser or as npx qamcp-cli, with HTML and JSON reports

Install