Mcpcheckup
io.github.fpetititPublished by GitHub account fpetititv0.1.0Updated Oct 24, 2026
Scans remote MCP servers for protocol, security, and TLS issues; exposes scan tools via MCP.
The publisher's own server: MCP Checkup
Overview
A remote MCP server that scans other remote MCP servers for protocol, security, TLS and licensing issues and returns a check dashboard.
- What you can do
- Scan a remote MCP server by URL and get a dashboard of results covering connectivity and handshake, protocol negotiation and advertised capabilities, plus a full inventory of tools, resources and prompts with schemas. Run security heuristics such as prompt-injection-style wording in tool descriptions, tools that may expose exec, filesystem or network capabilities, missing descriptions and plaintext transport. Check network and TLS details including certificate validity, HTTP security headers and CORS policy. Report whether a license file or license mention is present.
- When to use it
- Useful when you want to vet an MCP server before connecting to it, compare its advertised tools and capabilities, or get a quick heuristic read on its security posture and TLS setup.
- Requirements
- A remote endpoint at mcpcheckup.xyz over streamable HTTP; no authentication, environment variables or headers are declared. The target must be a public http:// or https:// URL, since private, internal and localhost addresses are blocked.
Installation
In SourceWeft
- Open Mcpcheckup in the dashboard and add it to a workspace.
- Enable the server for the chats that should use its tools.
Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.
Use with an agent
Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.
Read https://sourceweft.com/mcp/io.github.fpetitit%2Fmcpcheckup/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.Other MCP clients
Add this to your client's mcpServers config.
{
"mcpServers": {
"mcpcheckup": {
"type": "http",
"url": "https://mcpcheckup.xyz/api/mcp"
}
}
}README
mcpcheck
A webcheck.xyz-style scanner for remote MCP servers.
Enter the URL of an MCP server (Streamable HTTP or SSE transport) and get a dashboard of checks:
- Connectivity & Handshake — protocol negotiation, server info, advertised capabilities.
- Tools, Resources & Prompts — full inventory with schemas.
- Security Heuristics — prompt-injection-style wording in tool descriptions, tools that may expose sensitive capabilities (exec, filesystem, network), missing descriptions, plaintext transport.
- Network & TLS — certificate validity, HTTP security headers, CORS policy.
- License Information — presence of a LICENSE file or license mention in server instructions.
Development
Open http://localhost:3000 and paste an MCP server URL to scan.
Notes
- Only
http://andhttps://targets are accepted; scanning private/internal IP ranges orlocalhostis blocked to prevent SSRF. - Security checks are heuristic, not a substitute for a manual security review.
Source: README.md at commit 90a40a3
Tools
0Version history
1- v0.1.0LatestSep 16, 2026
Score
85% of the applicable checks met
How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.
- Reached in the last 30 daysRequired25 pts
- Auth declaredRequired10 pts
- Tools listedRequired15 pts
Answer tools/list without a credential, or ship a package that starts in a sandbox without one.
- DescriptionRequired15 pts
- Logo10 pts
- Documentation15 pts
- License10 pts
