protogrid

Search / com.mcpcheckup/mcp

MCP Checkup

R0· no sign-in

Observed facts on public MCP servers: protocol checks, tool changes, signed evidence. No verdicts.

v0.2.0 · active · website · descriptor JSON · versions

An agent can connect right now, no human step.Remote endpoint, no authentication, reachable on the last probe.
Quality80good
Trust82of 100
Uptime, 30 days97%
Latency p50448 ms

Connect

8 clients · secrets stay placeholders
{
  "mcpServers": {
    "mcpcheckup": {
      "type": "http",
      "url": "https://mcpcheckup.com/mcp"
    }
  }
}
claude mcp add --transport http mcpcheckup https://mcpcheckup.com/mcp
[mcp_servers.mcpcheckup]
url = "https://mcpcheckup.com/mcp"
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "mcpcheckup": {
      "type": "remote",
      "url": "https://mcpcheckup.com/mcp",
      "enabled": true
    }
  }
}
{
  "mcpServers": {
    "mcpcheckup": {
      "type": "http",
      "url": "https://mcpcheckup.com/mcp"
    }
  },
  "deeplink": "cursor://anysphere.cursor-deeplink/mcp/install?name=mcpcheckup&config=eyJ0eXBlIjoiaHR0cCIsInVybCI6Imh0dHBzOi8vbWNwY2hlY2t1cC5jb20vbWNwIn0%3D"
}
{
  "servers": {
    "mcpcheckup": {
      "type": "http",
      "url": "https://mcpcheckup.com/mcp"
    }
  }
}
{
  "mcpServers": {
    "mcpcheckup": {
      "httpUrl": "https://mcpcheckup.com/mcp"
    }
  }
}
extensions:
  "mcpcheckup":
    enabled: true
    name: "mcpcheckup"
    type: streamable_http
    uri: "https://mcpcheckup.com/mcp"
    timeout: 300

Quality 80 / 100good

protocol75 · weight 25
  • warn
    protocol.modernnewest supported version is 2025-11-25; 2026-07-28 not supported, older versions are deprecated until 2027-07-28
  • n/a
    protocol.statelessonly applies to 2026-07-28 servers
  • pass
    protocol.transportstreamable HTTP
  • n/a
    protocol.list_ttlonly applies to 2026-07-28 servers
authorizationn/a · weight 15
  • n/a
    auth.prm, auth.as_metadata, auth.cimdno remote uses OAuth
  • n/a
    auth.secret_in_urlno templated URL
tool hygiene86 · weight 30
  • pass
    tools.descriptionsevery tool has a description
  • warn
    tools.description_length6 tools have descriptions over 1,024 characters, which crowds the context
  • pass
    tools.schemasevery tool has an object input schema
  • pass
    tools.annotations6 of 6 tools declare readOnlyHint or destructiveHint
  • warn
    tools.directory_hints1 of 6 tools declare all four hints; missing: check_mcps (destructiveHint, idempotentHint); get_mcp_history (destructiveHint, idempotentHint); get_attestation (destructiveHint, idempotentHint); …
  • pass
    tools.token_costabout 3,364 tokens to load every tool
  • pass
    tools.api_dumptools are not a one-to-one API dump
stability75 · weight 15
  • warn
    stability.changes13 tool changes in 30 days
  • pass
    stability.rug_pullno tool changed its meaning under the same name
dependenciesn/a · weight 15
  • n/a
    deps.known_vulns, deps.mcp_sdk_version, deps.resolvableno npm or PyPI package

6 tools, about 3,364 tokens to load them all · tool set 4f6e00281aba · tools last changed 2026-10-17 · checked 2026-10-20 09:31 UTC

Tool changes

  • get_attestationchangeddescription
    before

    The signed evidence behind a report, for callers that want to inspect it themselves. Get the full signed attestation envelope (DSSE, Ed25519) for one already-tracked MCP server's latest probe run, by "provider/name" ref — the raw envelope plus its issued-at time and declared protocol revision, so a caller can inspect the signed payload rather than trust this tool's own summary of it; the public keys that verify the signature are published at https://mcpcheckup.com/.well-known/mcpcheckup-keys.json. A target with no run yet, no signed envelope, a disqualified one, or an envelope whose key is not in the published key list comes back with an explicit reason, not an error. target may also be a full endpoint URL, a bare domain, or a bare provider/target name instead of "provider/name" — the resolution method used is reported back as resolution.method ("ref", "endpoint", "host", or "name"). If an input matches more than one tracked target — or is a URL on a host we track that doesn't exactly match any of its endpoints — the response has status "ambiguous" with a short `candidates` list (each with a "provider/name" `ref` and its `report_url`, plus `candidate_total`, the full match count before the 5-entry cap) instead of guessing — call again with the exact ref you want. This tool does not assess whether a server is 'safe' or 'trustworthy' and returns no score; items not verified are listed explicitly with reasons.

    after · 92% of words in common

    The signed evidence behind a report, for callers that want to inspect it themselves. Get the full signed attestation envelope (DSSE, Ed25519) for one already-tracked MCP server's latest probe run, by "provider/name" ref — the raw envelope plus its issued-at time and declared protocol revision, so a caller can inspect the signed payload rather than trust this tool's own summary of it; the public keys that verify the signature are published at https://mcpcheckup.com/.well-known/mcpcheckup-keys.json. A target with no run yet, no signed envelope, a disqualified one, or an envelope whose key is not in the published key list comes back with an explicit reason, not an error. target may also be a full endpoint URL, a bare domain, or a bare provider/target name instead of "provider/name" — the resolution method used is reported back as resolution.method ("ref", "endpoint", "host", or "name"). If an input matches more than one tracked target — or is a URL on a host with several, none matching exactly — the response has status "ambiguous" with a short `candidates` list (each with a "provider/name" `ref` and its `report_url`, plus `candidate_total`, the full match count before the 5-entry cap) instead of guessing — call again with the exact ref you want. A URL matching only by host returns its target with `resolved_from`. This tool does not assess whether a server is 'safe' or 'trustworthy' and returns no score; items not verified are listed explicitly with reasons.

  • get_mcp_historychangeddescription
    before

    Whether an MCP server's toolset changed recently. Get recent history for one already-tracked MCP server on MCP Checkup, by "provider/name" ref (e.g. "acme/weather-mcp"). Events include the toolset's most recent change boundary (not a full change-by-change history) plus any recorded baseline-drift events, newest first, up to `limit` results (default 20, max 50). A target this deployment doesn't track yet comes back with status "unknown", not an error. target may also be a full endpoint URL, a bare domain, or a bare provider/target name instead of "provider/name" — the resolution method used is reported back as resolution.method ("ref", "endpoint", "host", or "name"). If an input matches more than one tracked target — or is a URL on a host we track that doesn't exactly match any of its endpoints — the response has status "ambiguous" with a short `candidates` list (each with a "provider/name" `ref` and its `report_url`, plus `candidate_total`, the full match count before the 5-entry cap) instead of guessing — call again with the exact ref you want. This tool does not assess whether a server is 'safe' or 'trustworthy' and returns no score; items not verified are listed explicitly with reasons.

    after · 67% of words in common

    Whether an MCP server's toolset changed recently. Get recent history for one already-tracked MCP server on MCP Checkup, by "provider/name" ref (e.g. "acme/weather-mcp"). Events, newest first, up to `limit` results (default 20, max 50): `tools_changed` (at most one: when the set of tool names last changed); `tools_change_detail` (one per recorded tool-list change, the 10 most recent at most, whether names, parameters or descriptions changed; `itemization` is "not_kept" for a change older than 30 days (its per-tool detail is not held), "unitemizable" when the stored lists cannot be compared tool by tool, otherwise "itemized" and `added`, `removed`, `parameters_changed` and `description_only` each give `names` (up to 10 tool names) and a `total`); `protocol_revision_changed` (the signed protocol_revision changed between runs whose probe offered the same revision, or because the server switched between the legacy initialize and server/discover handshakes); `probe_offered_revision_changed` (the revision our probe offered changed, with a `note`); and any recorded baseline-drift events. `truncated` is true when more exist than are listed. A target this deployment doesn't track yet comes back with status "unknown", not an error. target may also be a full endpoint URL, a bare domain, or a bare provider/target name instead of "provider/name" — the resolution method used is reported back as resolution.method ("ref", "endpoint", "host", or "name"). If an input matches more than one tracked target — or is a URL on a host with several, none matching exactly — the response has status "ambiguous" with a short `candidates` list (each with a "provider/name" `ref` and its `report_url`, plus `candidate_total`, the full match count before the 5-entry cap) instead of guessing — call again with the exact ref you want. A URL matching only by host returns its target with `resolved_from`. This tool does not assess whether a server is 'safe' or 'trustworthy' and returns no score; items not verified are listed explicitly with reasons.

  • get_mcp_reportchangeddescription
    before

    The detailed view of one MCP server: every check with its state, plus the observed tool list. Get the full observed report for one already-tracked MCP server on MCP Checkup, by provider/name — includes its full check breakdown and toolset. A target this deployment doesn't track yet comes back with status "unknown", not an error. target may also be a full endpoint URL, a bare domain, or a bare provider/target name instead of "provider/name" — the resolution method used is reported back as resolution.method ("ref", "endpoint", "host", or "name"). If an input matches more than one tracked target — or is a URL on a host we track that doesn't exactly match any of its endpoints — the response has status "ambiguous" with a short `candidates` list (each with a "provider/name" `ref` and its `report_url`, plus `candidate_total`, the full match count before the 5-entry cap) instead of guessing — call again with the exact ref you want. Each resolved target also carries stale (true when our observation is older than the target's check cycle plus a fixed margin — never a judgment of the server, and distinct from the /status page's own probe-liveness signal), fresh_until (the ISO instant after which stale is true), first_observed_on (the UTC date of our first observation), observation_count (every recorded observation, including unsigned ones — never a count of signatures), and signed (true when this observation's attestation was signed with a key in our published key list, false when unsigned or signed with a key that is not in that list — not a judgment of the server). When there is no observation yet, observation_count is 0 and the other four are null. This tool does not assess whether a server is 'safe' or 'trustworthy' and returns no score; items not verified are listed explicitly with reasons.

    after · 88% of words in common

    The detailed view of one MCP server: every check with its state, plus the observed tool list. Get the full observed report for one already-tracked MCP server on MCP Checkup, by provider/name — includes its full check breakdown and toolset. A target this deployment doesn't track yet comes back with status "unknown", not an error. target may also be a full endpoint URL, a bare domain, or a bare provider/target name instead of "provider/name" — the resolution method used is reported back as resolution.method ("ref", "endpoint", "host", or "name"). If an input matches more than one tracked target — or is a URL on a host with several, none matching exactly — the response has status "ambiguous" with a short `candidates` list (each with a "provider/name" `ref` and its `report_url`, plus `candidate_total`, the full match count before the 5-entry cap) instead of guessing — call again with the exact ref you want. A URL matching only by host returns its target with `resolved_from`. Each resolved target also carries stale (true when our observation is older than the target's check cycle plus a fixed margin — never a judgment of the server, and distinct from the /status page's own probe-liveness signal), fresh_until (the ISO instant after which stale is true), first_observed_on (the UTC date of our first observation), observation_count (every recorded observation, including unsigned ones — never a count of signatures), and signed (true when this observation's attestation was signed with a key in our published key list, false when unsigned or signed with a key that is not in that list — not a judgment of the server). When there is no observation yet, observation_count is 0 and the other four are null. Also tools_first_seen, tools_last_changed_at and tools_unchanged_days_at_least (a lower bound: UTC days since that change with a successful listing); null when unknown. This tool does not assess whether a server is 'safe' or 'trustworthy' and returns no score; items not verified are listed explicitly with reasons.

  • check_mcpschangeddescription
    before

    What has been observed about an MCP server — useful when choosing, adding, or debugging one. Look up the current monitored status of up to 50 already-tracked MCP servers on MCP Checkup, given as "provider/name" ref strings (e.g. "acme/weather-mcp"). Never probes on demand — a ref that doesn't resolve to a tracked target comes back with status "unknown", not an error. Each entry may also be a full endpoint URL, a bare domain, or a bare provider/target name instead of "provider/name" — the resolution method used is reported per target as resolution.method ("ref", "endpoint", "host", or "name"). If an input matches more than one tracked target — or is a URL on a host we track that doesn't exactly match any of its endpoints — the response has status "ambiguous" with a short `candidates` list (each with a "provider/name" `ref` and its `report_url`, plus `candidate_total`, the full match count before the 5-entry cap) instead of guessing — call again with the exact ref you want. Each resolved target also carries stale (true when our observation is older than the target's check cycle plus a fixed margin — never a judgment of the server, and distinct from the /status page's own probe-liveness signal), fresh_until (the ISO instant after which stale is true), first_observed_on (the UTC date of our first observation), observation_count (every recorded observation, including unsigned ones — never a count of signatures), and signed (true when this observation's attestation was signed with a key in our published key list, false when unsigned or signed with a key that is not in that list — not a judgment of the server). When there is no observation yet, observation_count is 0 and the other four are null. Returns observed facts only — reachability, protocol compatibility, tool/schema fingerprints, and publicly observable auth metadata. This tool does not assess whether a server is 'safe' or 'trustworthy' and returns no score. Items not verified are returned explicitly with reasons.

    after · 96% of words in common

    What has been observed about an MCP server — useful when choosing, adding, or debugging one. Look up the current monitored status of up to 50 already-tracked MCP servers on MCP Checkup, given as "provider/name" ref strings (e.g. "acme/weather-mcp"). Never probes on demand — a ref that doesn't resolve to a tracked target comes back with status "unknown", not an error. Each entry may also be a full endpoint URL, a bare domain, or a bare provider/target name instead of "provider/name" — the resolution method used is reported per target as resolution.method ("ref", "endpoint", "host", or "name"). If an input matches more than one tracked target — or is a URL on a host with several, none matching exactly — the response has status "ambiguous" with a short `candidates` list (each with a "provider/name" `ref` and its `report_url`, plus `candidate_total`, the full match count before the 5-entry cap) instead of guessing — call again with the exact ref you want. A URL matching only by host returns its target with `resolved_from`. Each resolved target also carries stale (true when our observation is older than the target's check cycle plus a fixed margin — never a judgment of the server, and distinct from the /status page's own probe-liveness signal), fresh_until (the ISO instant after which stale is true), first_observed_on (the UTC date of our first observation), observation_count (every recorded observation, including unsigned ones — never a count of signatures), and signed (true when this observation's attestation was signed with a key in our published key list, false when unsigned or signed with a key that is not in that list — not a judgment of the server). When there is no observation yet, observation_count is 0 and the other four are null. Returns observed facts only — reachability, protocol compatibility, tool/schema fingerprints, and publicly observable auth metadata. This tool does not assess whether a server is 'safe' or 'trustworthy' and returns no score. Items not verified are returned explicitly with reasons.

  • get_attestationchangeddescription
    before

    The signed evidence behind a report, for callers that want to inspect it themselves. Get the full signed attestation envelope (DSSE, Ed25519) for one already-tracked MCP server's latest probe run, by "provider/name" ref — the raw envelope plus its issued-at time and declared protocol revision, so a caller can inspect the signed payload rather than trust this tool's own summary of it; the public key needed to verify the signature is not published yet. A target with no run yet, no signed envelope, or a disqualified one comes back with an explicit reason, not an error. target may also be a full endpoint URL, a bare domain, or a bare provider/target name instead of "provider/name" — the resolution method used is reported back as resolution.method ("ref", "endpoint", "host", or "name"). If an input matches more than one tracked target — or is a URL on a host we track that doesn't exactly match any of its endpoints — the response has status "ambiguous" with a short `candidates` list (each with a "provider/name" `ref` and its `report_url`, plus `candidate_total`, the full match count before the 5-entry cap) instead of guessing — call again with the exact ref you want. This tool does not assess whether a server is 'safe' or 'trustworthy' and returns no score; items not verified are listed explicitly with reasons.

    after · 93% of words in common

    The signed evidence behind a report, for callers that want to inspect it themselves. Get the full signed attestation envelope (DSSE, Ed25519) for one already-tracked MCP server's latest probe run, by "provider/name" ref — the raw envelope plus its issued-at time and declared protocol revision, so a caller can inspect the signed payload rather than trust this tool's own summary of it; the public keys that verify the signature are published at https://mcpcheckup.com/.well-known/mcpcheckup-keys.json. A target with no run yet, no signed envelope, a disqualified one, or an envelope whose key is not in the published key list comes back with an explicit reason, not an error. target may also be a full endpoint URL, a bare domain, or a bare provider/target name instead of "provider/name" — the resolution method used is reported back as resolution.method ("ref", "endpoint", "host", or "name"). If an input matches more than one tracked target — or is a URL on a host we track that doesn't exactly match any of its endpoints — the response has status "ambiguous" with a short `candidates` list (each with a "provider/name" `ref` and its `report_url`, plus `candidate_total`, the full match count before the 5-entry cap) instead of guessing — call again with the exact ref you want. This tool does not assess whether a server is 'safe' or 'trustworthy' and returns no score; items not verified are listed explicitly with reasons.

  • get_mcp_reportchangeddescription
    before

    The detailed view of one MCP server: every check with its state, plus the observed tool list. Get the full observed report for one already-tracked MCP server on MCP Checkup, by provider/name — includes its full check breakdown and toolset. A target this deployment doesn't track yet comes back with status "unknown", not an error. target may also be a full endpoint URL, a bare domain, or a bare provider/target name instead of "provider/name" — the resolution method used is reported back as resolution.method ("ref", "endpoint", "host", or "name"). If an input matches more than one tracked target — or is a URL on a host we track that doesn't exactly match any of its endpoints — the response has status "ambiguous" with a short `candidates` list (each with a "provider/name" `ref` and its `report_url`, plus `candidate_total`, the full match count before the 5-entry cap) instead of guessing — call again with the exact ref you want. Each resolved target also carries stale (true when our observation is older than the target's check cycle plus a fixed margin — never a judgment of the server, and distinct from the /status page's own probe-liveness signal), fresh_until (the ISO instant after which stale is true), first_observed_on (the UTC date of our first observation), observation_count (every recorded observation, including unsigned ones — never a count of signatures), and signed (true when this observation carries a DSSE-signed attestation, false when unsigned — not a judgment of the server). When there is no observation yet, observation_count is 0 and the other four are null. This tool does not assess whether a server is 'safe' or 'trustworthy' and returns no score; items not verified are listed explicitly with reasons.

    after · 97% of words in common

    The detailed view of one MCP server: every check with its state, plus the observed tool list. Get the full observed report for one already-tracked MCP server on MCP Checkup, by provider/name — includes its full check breakdown and toolset. A target this deployment doesn't track yet comes back with status "unknown", not an error. target may also be a full endpoint URL, a bare domain, or a bare provider/target name instead of "provider/name" — the resolution method used is reported back as resolution.method ("ref", "endpoint", "host", or "name"). If an input matches more than one tracked target — or is a URL on a host we track that doesn't exactly match any of its endpoints — the response has status "ambiguous" with a short `candidates` list (each with a "provider/name" `ref` and its `report_url`, plus `candidate_total`, the full match count before the 5-entry cap) instead of guessing — call again with the exact ref you want. Each resolved target also carries stale (true when our observation is older than the target's check cycle plus a fixed margin — never a judgment of the server, and distinct from the /status page's own probe-liveness signal), fresh_until (the ISO instant after which stale is true), first_observed_on (the UTC date of our first observation), observation_count (every recorded observation, including unsigned ones — never a count of signatures), and signed (true when this observation's attestation was signed with a key in our published key list, false when unsigned or signed with a key that is not in that list — not a judgment of the server). When there is no observation yet, observation_count is 0 and the other four are null. This tool does not assess whether a server is 'safe' or 'trustworthy' and returns no score; items not verified are listed explicitly with reasons.

  • check_mcpschangeddescription
    before

    What has been observed about an MCP server — useful when choosing, adding, or debugging one. Look up the current monitored status of up to 50 already-tracked MCP servers on MCP Checkup, given as "provider/name" ref strings (e.g. "acme/weather-mcp"). Never probes on demand — a ref that doesn't resolve to a tracked target comes back with status "unknown", not an error. Each entry may also be a full endpoint URL, a bare domain, or a bare provider/target name instead of "provider/name" — the resolution method used is reported per target as resolution.method ("ref", "endpoint", "host", or "name"). If an input matches more than one tracked target — or is a URL on a host we track that doesn't exactly match any of its endpoints — the response has status "ambiguous" with a short `candidates` list (each with a "provider/name" `ref` and its `report_url`, plus `candidate_total`, the full match count before the 5-entry cap) instead of guessing — call again with the exact ref you want. Each resolved target also carries stale (true when our observation is older than the target's check cycle plus a fixed margin — never a judgment of the server, and distinct from the /status page's own probe-liveness signal), fresh_until (the ISO instant after which stale is true), first_observed_on (the UTC date of our first observation), observation_count (every recorded observation, including unsigned ones — never a count of signatures), and signed (true when this observation carries a DSSE-signed attestation, false when unsigned — not a judgment of the server). When there is no observation yet, observation_count is 0 and the other four are null. Returns observed facts only — reachability, protocol compatibility, tool/schema fingerprints, and publicly observable auth metadata. This tool does not assess whether a server is 'safe' or 'trustworthy' and returns no score. Items not verified are returned explicitly with reasons.

    after · 97% of words in common

    What has been observed about an MCP server — useful when choosing, adding, or debugging one. Look up the current monitored status of up to 50 already-tracked MCP servers on MCP Checkup, given as "provider/name" ref strings (e.g. "acme/weather-mcp"). Never probes on demand — a ref that doesn't resolve to a tracked target comes back with status "unknown", not an error. Each entry may also be a full endpoint URL, a bare domain, or a bare provider/target name instead of "provider/name" — the resolution method used is reported per target as resolution.method ("ref", "endpoint", "host", or "name"). If an input matches more than one tracked target — or is a URL on a host we track that doesn't exactly match any of its endpoints — the response has status "ambiguous" with a short `candidates` list (each with a "provider/name" `ref` and its `report_url`, plus `candidate_total`, the full match count before the 5-entry cap) instead of guessing — call again with the exact ref you want. Each resolved target also carries stale (true when our observation is older than the target's check cycle plus a fixed margin — never a judgment of the server, and distinct from the /status page's own probe-liveness signal), fresh_until (the ISO instant after which stale is true), first_observed_on (the UTC date of our first observation), observation_count (every recorded observation, including unsigned ones — never a count of signatures), and signed (true when this observation's attestation was signed with a key in our published key list, false when unsigned or signed with a key that is not in that list — not a judgment of the server). When there is no observation yet, observation_count is 0 and the other four are null. Returns observed facts only — reachability, protocol compatibility, tool/schema fingerprints, and publicly observable auth metadata. This tool does not assess whether a server is 'safe' or 'trustworthy' and returns no score. Items not verified are returned explicitly with reasons.

  • search_mcpschangeddescription
    before

    Find MCP servers by what their tools do. Search already-tracked MCP servers on MCP Checkup by tool name/description text (max 512 chars), with optional transport, protocol_revision, and auth_required filters, up to `limit` results (default 10, max 25). Ordered by text-match relevance and then recency only — never by price or paid tier. Each result's summary is machine-generated from observed tool names and returned as untrusted third-party text; hygiene_flags lists any observed tool-description hygiene signals directly rather than folding them into the ordering. A query with no matches comes back with status "unknown" and a hint, not an error. Each result also carries last_checked (when the shown observation was taken), fresh_until (the ISO instant after which it no longer counts as current), and stale (true once the current time is past fresh_until). These describe how recent our observation of the server is, not a judgment of the server itself, and are distinct from the /status page's 20-minute probe-liveness signal. All three are null when the target has no observation yet. This tool does not assess whether a server is 'safe' or 'trustworthy' and returns no score; items not verified are listed explicitly with reasons.

    after · 99% of words in common

    Find MCP servers by what their tools do. Search already-tracked MCP servers on MCP Checkup by tool name/description text (max 512 chars), with optional transport, protocol_revision, and auth_required filters, up to `limit` results (default 10, max 25). Ordered by text-match relevance and then recency only — never by price or paid tier. Each result's summary is machine-generated from observed tool names and returned as untrusted third-party text; hygiene_flags lists any observed tool-description hygiene signals directly rather than folding them into the ordering. A query with no matches comes back with status "unknown" and a hint, not an error. Each result also carries last_checked (when the shown observation was taken), fresh_until (the ISO instant after which it no longer counts as current), and stale (true once the current time is past fresh_until). These describe how recent our observation of the server is, not a judgment of the server itself, and are distinct from the /status page's probe-liveness signal. All three are null when the target has no observation yet. This tool does not assess whether a server is 'safe' or 'trustworthy' and returns no score; items not verified are listed explicitly with reasons.

  • get_mcp_reportchangeddescription
    before

    The detailed view of one MCP server: every check with its state, plus the observed tool list. Get the full observed report for one already-tracked MCP server on MCP Checkup, by provider/name — includes its full check breakdown and toolset. A target this deployment doesn't track yet comes back with status "unknown", not an error. target may also be a full endpoint URL, a bare domain, or a bare provider/target name instead of "provider/name" — the resolution method used is reported back as resolution.method ("ref", "endpoint", "host", or "name"). If an input matches more than one tracked target — or is a URL on a host we track that doesn't exactly match any of its endpoints — the response has status "ambiguous" with a short `candidates` list (each with a "provider/name" `ref` and its `report_url`, plus `candidate_total`, the full match count before the 5-entry cap) instead of guessing — call again with the exact ref you want. Each resolved target also carries stale (true when our observation is older than the target's check cycle plus a fixed margin — never a judgment of the server, and distinct from the /status page's own 20-minute probe-liveness signal), fresh_until (the ISO instant after which stale is true), first_observed_on (the UTC date of our first observation), observation_count (every recorded observation, including unsigned ones — never a count of signatures), and signed (true when this observation carries a DSSE-signed attestation, false when unsigned — not a judgment of the server). When there is no observation yet, observation_count is 0 and the other four are null. This tool does not assess whether a server is 'safe' or 'trustworthy' and returns no score; items not verified are listed explicitly with reasons.

    after · 99% of words in common

    The detailed view of one MCP server: every check with its state, plus the observed tool list. Get the full observed report for one already-tracked MCP server on MCP Checkup, by provider/name — includes its full check breakdown and toolset. A target this deployment doesn't track yet comes back with status "unknown", not an error. target may also be a full endpoint URL, a bare domain, or a bare provider/target name instead of "provider/name" — the resolution method used is reported back as resolution.method ("ref", "endpoint", "host", or "name"). If an input matches more than one tracked target — or is a URL on a host we track that doesn't exactly match any of its endpoints — the response has status "ambiguous" with a short `candidates` list (each with a "provider/name" `ref` and its `report_url`, plus `candidate_total`, the full match count before the 5-entry cap) instead of guessing — call again with the exact ref you want. Each resolved target also carries stale (true when our observation is older than the target's check cycle plus a fixed margin — never a judgment of the server, and distinct from the /status page's own probe-liveness signal), fresh_until (the ISO instant after which stale is true), first_observed_on (the UTC date of our first observation), observation_count (every recorded observation, including unsigned ones — never a count of signatures), and signed (true when this observation carries a DSSE-signed attestation, false when unsigned — not a judgment of the server). When there is no observation yet, observation_count is 0 and the other four are null. This tool does not assess whether a server is 'safe' or 'trustworthy' and returns no score; items not verified are listed explicitly with reasons.

  • check_mcpschangeddescription
    before

    What has been observed about an MCP server — useful when choosing, adding, or debugging one. Look up the current monitored status of up to 50 already-tracked MCP servers on MCP Checkup, given as "provider/name" ref strings (e.g. "acme/weather-mcp"). Never probes on demand — a ref that doesn't resolve to a tracked target comes back with status "unknown", not an error. Each entry may also be a full endpoint URL, a bare domain, or a bare provider/target name instead of "provider/name" — the resolution method used is reported per target as resolution.method ("ref", "endpoint", "host", or "name"). If an input matches more than one tracked target — or is a URL on a host we track that doesn't exactly match any of its endpoints — the response has status "ambiguous" with a short `candidates` list (each with a "provider/name" `ref` and its `report_url`, plus `candidate_total`, the full match count before the 5-entry cap) instead of guessing — call again with the exact ref you want. Each resolved target also carries stale (true when our observation is older than the target's check cycle plus a fixed margin — never a judgment of the server, and distinct from the /status page's own 20-minute probe-liveness signal), fresh_until (the ISO instant after which stale is true), first_observed_on (the UTC date of our first observation), observation_count (every recorded observation, including unsigned ones — never a count of signatures), and signed (true when this observation carries a DSSE-signed attestation, false when unsigned — not a judgment of the server). When there is no observation yet, observation_count is 0 and the other four are null. Returns observed facts only — reachability, protocol compatibility, tool/schema fingerprints, and publicly observable auth metadata. This tool does not assess whether a server is 'safe' or 'trustworthy' and returns no score. Items not verified are returned explicitly with reasons.

    after · 99% of words in common

    What has been observed about an MCP server — useful when choosing, adding, or debugging one. Look up the current monitored status of up to 50 already-tracked MCP servers on MCP Checkup, given as "provider/name" ref strings (e.g. "acme/weather-mcp"). Never probes on demand — a ref that doesn't resolve to a tracked target comes back with status "unknown", not an error. Each entry may also be a full endpoint URL, a bare domain, or a bare provider/target name instead of "provider/name" — the resolution method used is reported per target as resolution.method ("ref", "endpoint", "host", or "name"). If an input matches more than one tracked target — or is a URL on a host we track that doesn't exactly match any of its endpoints — the response has status "ambiguous" with a short `candidates` list (each with a "provider/name" `ref` and its `report_url`, plus `candidate_total`, the full match count before the 5-entry cap) instead of guessing — call again with the exact ref you want. Each resolved target also carries stale (true when our observation is older than the target's check cycle plus a fixed margin — never a judgment of the server, and distinct from the /status page's own probe-liveness signal), fresh_until (the ISO instant after which stale is true), first_observed_on (the UTC date of our first observation), observation_count (every recorded observation, including unsigned ones — never a count of signatures), and signed (true when this observation carries a DSSE-signed attestation, false when unsigned — not a judgment of the server). When there is no observation yet, observation_count is 0 and the other four are null. Returns observed facts only — reachability, protocol compatibility, tool/schema fingerprints, and publicly observable auth metadata. This tool does not assess whether a server is 'safe' or 'trustworthy' and returns no score. Items not verified are returned explicitly with reasons.

Showing the latest 10. Full history: list_changes · trend: quality JSON.

Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed. How it is computed.

Trust 82 / 100

no-repository
provenance55
liveness99
freshness100
hygiene80

+dns-namespace +website +reachable +uptime-97% +updated-29d-ago -no-repository

Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed. How it is computed.

Endpoints

remoteauthreachableuptime 30dp50protocollast ok
https://mcpcheckup.com/mcp streamable-httpnoneyes97%448 ms2025-11-252026-10-20

Tools (6)

check_mcpsread-onlyWhat has been observed about an MCP server — useful when choosing, adding, or debugging one. Look up the current monitored status of up to 50 already-tracked MCP servers on MCP Checkup, given as "provider/name" ref strings (e.g. "acme/weather-mcp"). Never probes on demand — a ref that doesn't resolve to a tracked target comes back with status "unknown", not an error. Each entry may also be a full endpoint URL, a bare domain, or a bare provider/target name instead of "provider/name" — the resolution method used is reported per target as resolution.method ("ref", "endpoint", "host", or "name"). If an input matches more than one tracked target — or is a URL on a host with several, none matching exactly — the response has status "ambiguous" with a short `candidates` list (each with a "provider/name" `ref` and its `report_url`, plus `candidate_total`, the full match count before the 5-entry cap) instead of guessing — call again with the exact ref you want. A URL matching only by host returns its target with `resolved_from`. Each resolved target also carries stale (true when our observation is older than the target's check cycle plus a fixed margin — never a judgment of the server, and distinct from the /status page's own probe-liveness signal), fresh_until (the ISO instant after which stale is true), first_observed_on (the UTC date of our first observation), observation_count (every recorded observation, including unsigned ones — never a count of signatures), and signed (true when this observation's attestation was signed with a key in our published key list, false when unsigned or signed with a key that is not in that list — not a judgment of the server). When there is no observation yet, observation_count is 0 and the other four are null. Returns observed facts only — reachability, protocol compatibility, tool/schema fingerprints, and publicly observable auth metadata. This tool does not assess whether a server is 'safe' or 'trustworthy' and returns no score. Items not verified are returned explicitly with reasons.
get_attestationread-onlyThe signed evidence behind a report, for callers that want to inspect it themselves. Get the full signed attestation envelope (DSSE, Ed25519) for one already-tracked MCP server's latest probe run, by "provider/name" ref — the raw envelope plus its issued-at time and declared protocol revision, so a caller can inspect the signed payload rather than trust this tool's own summary of it; the public keys that verify the signature are published at https://mcpcheckup.com/.well-known/mcpcheckup-keys.json. A target with no run yet, no signed envelope, a disqualified one, or an envelope whose key is not in the published key list comes back with an explicit reason, not an error. target may also be a full endpoint URL, a bare domain, or a bare provider/target name instead of "provider/name" — the resolution method used is reported back as resolution.method ("ref", "endpoint", "host", or "name"). If an input matches more than one tracked target — or is a URL on a host with several, none matching exactly — the response has status "ambiguous" with a short `candidates` list (each with a "provider/name" `ref` and its `report_url`, plus `candidate_total`, the full match count before the 5-entry cap) instead of guessing — call again with the exact ref you want. A URL matching only by host returns its target with `resolved_from`. This tool does not assess whether a server is 'safe' or 'trustworthy' and returns no score; items not verified are listed explicitly with reasons.
get_mcp_historyread-onlyWhether an MCP server's toolset changed recently. Get recent history for one already-tracked MCP server on MCP Checkup, by "provider/name" ref (e.g. "acme/weather-mcp"). Events, newest first, up to `limit` results (default 20, max 50): `tools_changed` (at most one: when the set of tool names last changed); `tools_change_detail` (one per recorded tool-list change, the 10 most recent at most, whether names, parameters or descriptions changed; `itemization` is "not_kept" for a change older than 30 days (its per-tool detail is not held), "unitemizable" when the stored lists cannot be compared tool by tool, otherwise "itemized" and `added`, `removed`, `parameters_changed` and `description_only` each give `names` (up to 10 tool names) and a `total`); `protocol_revision_changed` (the signed protocol_revision changed between runs whose probe offered the same revision, or because the server switched between the legacy initialize and server/discover handshakes); `probe_offered_revision_changed` (the revision our probe offered changed, with a `note`); and any recorded baseline-drift events. `truncated` is true when more exist than are listed. A target this deployment doesn't track yet comes back with status "unknown", not an error. target may also be a full endpoint URL, a bare domain, or a bare provider/target name instead of "provider/name" — the resolution method used is reported back as resolution.method ("ref", "endpoint", "host", or "name"). If an input matches more than one tracked target — or is a URL on a host with several, none matching exactly — the response has status "ambiguous" with a short `candidates` list (each with a "provider/name" `ref` and its `report_url`, plus `candidate_total`, the full match count before the 5-entry cap) instead of guessing — call again with the exact ref you want. A URL matching only by host returns its target with `resolved_from`. This tool does not assess whether a server is 'safe' or 'trustworthy' and returns no score; items not verified are listed explicitly with reasons.
get_mcp_reportread-onlyThe detailed view of one MCP server: every check with its state, plus the observed tool list. Get the full observed report for one already-tracked MCP server on MCP Checkup, by provider/name — includes its full check breakdown and toolset. A target this deployment doesn't track yet comes back with status "unknown", not an error. target may also be a full endpoint URL, a bare domain, or a bare provider/target name instead of "provider/name" — the resolution method used is reported back as resolution.method ("ref", "endpoint", "host", or "name"). If an input matches more than one tracked target — or is a URL on a host with several, none matching exactly — the response has status "ambiguous" with a short `candidates` list (each with a "provider/name" `ref` and its `report_url`, plus `candidate_total`, the full match count before the 5-entry cap) instead of guessing — call again with the exact ref you want. A URL matching only by host returns its target with `resolved_from`. Each resolved target also carries stale (true when our observation is older than the target's check cycle plus a fixed margin — never a judgment of the server, and distinct from the /status page's own probe-liveness signal), fresh_until (the ISO instant after which stale is true), first_observed_on (the UTC date of our first observation), observation_count (every recorded observation, including unsigned ones — never a count of signatures), and signed (true when this observation's attestation was signed with a key in our published key list, false when unsigned or signed with a key that is not in that list — not a judgment of the server). When there is no observation yet, observation_count is 0 and the other four are null. Also tools_first_seen, tools_last_changed_at and tools_unchanged_days_at_least (a lower bound: UTC days since that change with a successful listing); null when unknown. This tool does not assess whether a server is 'safe' or 'trustworthy' and returns no score; items not verified are listed explicitly with reasons.
request_checkAsk for a one-off public observation of the MCP server at a full endpoint URL — this is the only tool here that contacts a third-party server, and it contacts exactly the host you name. `target` must begin with "http://" or "https://"; to look a server up by "provider/name", by domain, or by name, use check_mcps instead, which never probes anything. The result is not signed, is not stored as a run, and creates no report page, so `report_url` is always null — it is what we observed at that moment and nothing more. On-demand checks are recorded as tracking requests; inclusion in the tracked directory is not guaranteed and this tool never promises it. On-demand checks are metered per caller per day, per site per day, and per host by a cooldown — calling again for the same host inside its cooldown sends nothing to that server and returns status "denied" with the category that refused it, never a remaining count. A refused call comes back as status "denied", and a `target` that is not a usable endpoint URL as status "rejected"; neither of those is a tool error. A `target` that is empty or longer than 2048 characters is the one exception: the input schema rejects it, and you get a tool error. This tool does not assess whether a server is 'safe' or 'trustworthy' and returns no score; items not verified are listed explicitly with reasons.
search_mcpsread-onlyFind MCP servers by what their tools do. Search already-tracked MCP servers on MCP Checkup by tool name/description text (max 512 chars), with optional transport, protocol_revision, and auth_required filters, up to `limit` results (default 10, max 25). Ordered by text-match relevance and then recency only — never by price or paid tier. Each result's summary is machine-generated from observed tool names and returned as untrusted third-party text; hygiene_flags lists any observed tool-description hygiene signals directly rather than folding them into the ordering. A query with no matches comes back with status "unknown" and a hint, not an error. Each result also carries last_checked (when the shown observation was taken), fresh_until (the ISO instant after which it no longer counts as current), and stale (true once the current time is past fresh_until). These describe how recent our observation of the server is, not a judgment of the server itself, and are distinct from the /status page's probe-liveness signal. All three are null when the target has no observation yet. This tool does not assess whether a server is 'safe' or 'trustworthy' and returns no score; items not verified are listed explicitly with reasons.

Schemas: list_tools.

Similar MCP servers

Official server.json
{
  "name": "com.mcpcheckup/mcp",
  "title": "MCP Checkup",
  "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
  "remotes": [
    {
      "url": "https://mcpcheckup.com/mcp",
      "type": "streamable-http"
    }
  ],
  "version": "0.2.0",
  "websiteUrl": "https://mcpcheckup.com",
  "description": "Observed facts on public MCP servers: protocol checks, tool changes, signed evidence. No verdicts."
}