Free tool · Free account required
MCP Inspector —
test any MCP server from your browser.
Enter a URL and run a live JSON-RPC 2.0 handshake against any Model Context Protocol server — no install, no client config. See serverInfo, capabilities, the full tools/list, and whether the server is OAuth-protected.
Built for servers in the MCP ecosystem
What it shows you
Live initialize handshake
Sends a real JSON-RPC 2.0 initialize request over Streamable HTTP — with SSE-framed responses handled — and shows the serverInfo, protocolVersion, and declared capabilities the server answers with.
Tools, resources, prompts and events
Calls tools/list and lists resources, prompts and, for servers that advertise the draft MCP Events extension, the events/list catalog with delivery modes and payload schemas. Listed only: nothing is read, requested or polled.
OAuth-protected server detection
A 401 with a WWW-Authenticate challenge doesn't end the scan — the inspector recognizes it as an OAuth-protected MCP server, reports it as such, and surfaces the RFC 9728 protected-resource metadata URL.
Server card discovery (SEP-2127)
Checks /.well-known/mcp/server-card — the experimental MCP discovery extension — so you can see whether a server publishes discovery metadata before any client connects.
A2A and ARD on the same scan
Every scan also checks for an A2A agent card and an ARD ard.json manifest, so you see a service's full agent-protocol surface — not just MCP — in one result.
Full report download
Download the complete scan — handshake result, capabilities, tool list, server card, and raw JSON — as a single report file for documentation or review. Pro feature.
Endpoints probed on every scan
Addresses OWASP Agentic Skills Top 10
Detection and reporting, not enforcement — pairs with the permission-manifest, cryptographic-pinning, and approval-workflow controls OWASP also recommends for each risk.
Who uses it
MCP server developers
Verify your Streamable HTTP endpoint from the outside before announcing it: does server/discover answer, are your tools and events listed with useful descriptions, does your OAuth challenge carry the right resource metadata?
AI engineers evaluating servers
Check what a third-party MCP server actually exposes before wiring it into Claude, Cursor, or a LangGraph agent — tool surface, capabilities, and auth requirements in one scan, no client config needed.
Security teams
MCP servers are a new class of externally reachable endpoint. Enumerate what a server advertises to any anonymous client and confirm auth-protected servers actually reject unauthenticated initialize calls.