What happens
- One probe from our servers: the protocol handshake (2026-07-28
server/discoveror the olderinitialize),tools/listwhen it needs no sign-in, and the public OAuth metadata when it does. - We never send credentials, never call a tool and never reach private or internal addresses. URLs carrying credentials are refused.
- The result gets a private link you can share; it is kept for 30 days and never listed or indexed.
- Agents can run the same check through the REST API or the
check_servertool of our MCP server.
Directory requirements come from the Claude and OpenAI documentation; a clean result does not mean a directory will accept a server, and no audit is implied. How the check works.