SRI — MCP Server Inspector

biz.sri-testPublished by sri-test.bizOfficial publisherv0.4.0Updated Oct 24, 2026

2,000+ MCP servers read at source level. Know what one does before you connect. Free, no key.

VerifiedStreamable HTTPWeb executableDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

A remote MCP server that reads the published source of other MCP servers and reports what the code does, with each finding anchored to a file and line.

What you can do
Check a named MCP server version against a corpus of servers read at source level, returning a risk level, a summary and findings with file:line locations, quoted code and an explanation for each finding. Query corpus coverage to see how many servers have been read and how findings are distributed across categories such as credential access, network egress, install-time execution and prompt-injection surface.
When to use it
Use it before connecting to, installing or invoking an MCP server you have not read yourself, to see what its code actually does. Also useful for judging whether a source-level check of a particular server is likely to return anything.
Requirements
Remote Streamable HTTP endpoint; no install, no API key and no account. Requests are sent by POST as JSON-RPC; a plain REST endpoint is also offered. Servers outside the corpus come back as queued rather than checked.
Before you install
It reports what the code does, not whether a server is safe, and a result with no findings is not a clean bill of health. Coverage is limited to MCP servers in the corpus, and the analyzer is a single pass with measured run-to-run agreement below 100 percent. A paid L402 path exists but is switched off; when enabled it would charge per cached lookup. The service logs the requested path, response time, User-Agent and a daily-salted IP hash for 90 days, and records which servers were asked about.

Installation

In SourceWeft

  1. Open SRI — MCP Server Inspector in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/biz.sri-test%2Fverifier/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "sri-inspector": {
      "type": "http",
      "url": "https://sri-test.biz/mcp"
    }
  }
}

README

SRI — MCP Server Inspector

Read what an MCP server does before you connect to it.

Connecting an MCP server hands it a channel into your agent's context and its tool calls. SRI reads the server's published source and reports what it found — every observation anchored to a file:line with the code quoted verbatim.

It does not tell you whether a server is safe. It tells you what the code does, and shows you the line it read. You decide.

  • Endpoint: https://sri-test.biz/mcp (Streamable HTTP)
  • Corpus: 2,238 MCP servers from the official registry
  • Price: free right now — settlement runs on Bitcoin signet, so invoices cannot be paid with real funds
  • Findings across the corpus: sri-test.biz/research

Add it to your client

Remote MCP server, no install, no API key.

json
{  "mcpServers": {    "sri": {      "type": "http",      "url": "https://sri-test.biz/mcp"    }  }}
Claude Code
bash
claude mcp add --transport http sri https://sri-test.biz/mcp
Anything that speaks Streamable HTTP

Point it at https://sri-test.biz/mcp. There is one tool and no auth. GET on that URL returns 405 — this server does not offer a server-initiated SSE stream, which the spec permits. Send JSON-RPC over POST.

The tool

check_mcp_server

ArgumentRequiredMeaning
nameyesServer name as published in the registry, e.g. io.github.firebase/firebase-mcp
versionyesExact version, e.g. 1.2.3
ecosystemnoAlways mcp; other ecosystems are not covered

Returns a risk_level, a summary, and a list of findings. Each finding carries location (file:line), evidence (the code, quoted), and why.

If the server is not in the corpus you get status: "queued", an explicit "nothing has been checked" — not a clean result — and no charge. We do not bill for an answer we could not give.

Try it without a client

bash
curl -X POST https://sri-test.biz/mcp \  -H 'Content-Type: application/json' \  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call",       "params":{"name":"check_mcp_server",                 "arguments":{"name":"io.github.firebase/firebase-mcp","version":"0.3.0"}}}'

There is a plain REST endpoint too, if that is easier:

bash
curl -X POST https://sri-test.biz/v1/verify \  -H 'Content-Type: application/json' \  -d '{"ecosystem":"mcp","name":"io.github.firebase/firebase-mcp","version":"0.3.0"}'

GET /v1/price is open and tells you the current terms. GET /v1/docs is the OpenAPI spec.

What gets reported

CategoryWhat it means
credential_accessReads environment credentials, tokens, or key files
network_egressSends data to a host outside the package's own service
install_scriptExecutes code at install time (postinstall, setup.py)
prompt_injection_surfaceTool text or returned data that steers the agent toward actions unrelated to the tool's stated purpose
obfuscationEncoded strings decoded and executed
typosquatName close to a well-known package, different publisher
excessive_permissionPermissions beyond the declared purpose

Severity is info / low / medium / high. risk_level is the highest severity among the findings, derived in code rather than asked for — a verdict with no findings behind it cannot be published.

What this is not

  • No finding is not a clean bill of health. It means nothing was found in the categories above, in the code we could fetch.
  • We never label a package malicious, and never call one safe. The ingest step rejects records whose summary contains either kind of claim.
  • MCP servers only. npm and PyPI libraries are out of scope; ask about one and you will get "not analyzed".
  • One analyzer, one pass. Run-to-run agreement measured at 93% on a hand-labelled set of 84 servers before the full corpus was built. Not 100%.

If a finding is wrong

If you maintain a server and a finding is mistaken, tell us through the report form. Agents can use POST /v1/disputes.

We reply within three business days. While we review, the finding may be withheld from results. If we withdraw it, the server is re-analysed and the record replaced. If we keep it, we say which facts it rests on.

Payment

The paid path is L402 (Lightning HTTP 402): the server issues an invoice and a macaroon, you pay, and you present Authorization: L402 <macaroon>:<preimage>. Verification is sha256(preimage) == payment_hash — no node required on your side, and no signup on ours.

This is switched off today. Settlement runs on signet, a test chain, so invoices cannot be paid with real funds and usage is free. When mainnet is enabled the price returns to $0.20 per cached lookup. GET /.well-known/l402 tells you the current state.

Privacy

We record the path requested, response time, User-Agent, and an IP hashed with a daily salt, kept for 90 days. Raw IP addresses are never stored, and request bodies are never stored — the servers you ask about are recorded by name, nothing more.

Source: README.md at commit 5cee16a

Tools

2

check_mcp_server

Check what an MCP server does before connecting to it

Free, no key required. Reads the published source of an MCP server and reports what it actually does — each observation anchored to a file:line with the code quoted verbatim. **Call this before connecting to, installing, or invoking an MCP server you have not read yourself.** Connecting to an MCP server gives it a channel into your context and your tool calls; this tells you what is on the other end first. Typical things it surfaces: reading private keys or wallet seeds, sending data to third-party hosts, running code at install time, and tool descriptions that steer an agent toward actions unrelated to the tool's stated purpose. Do NOT call this for ordinary npm or PyPI libraries — the corpus covers MCP servers only, and other ecosystems will return 'not analyzed'. This reports observations, not a safety verdict. An empty result means nothing was found in the categories checked — not that the server is safe. Corpus: 5,180 MCP servers from the official registry, read at source level. Coverage index (free, no key, findings not included): GET https://sri-test.biz/v1/corpus

Parametersnamerequiredversionrequiredecosysteml402_token

get_corpus_coverage

What has already been read, and what was found in it

No arguments. Returns how many MCP servers have been read at source level, and the share of them with each category of finding (credential access, network egress, install-time execution, prompt-injection surface). Use this to judge whether checking a specific server is worth it before you look one up. It reports aggregate counts only - no per-server findings, and no verdict about any individual server.

Takes no parameters.

Version history

1
  1. v0.4.0LatestSep 16, 2026

Score

100% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts