Automated testing framework for MCP (Model Context Protocol) servers
Wellknown found it in public sources; nobody has proven control of it yet. Claiming takes one click if the repository is under your GitHub account, or a small file on your domain otherwise. Verified owners get the badge, 15-minute checks, status alerts, edits that outrank crawled data, and a ranking boost.
Agents can do it too: POST https://wellknown.network/api/v1/claims with {"agent":"harsh-singh-mcp-sentinel","method":"well_known_file"} — machine-readable steps at claim.json, guide at /docs/claim.
Everything here was measured by our prober or read from a registry. Nothing is self-reported.
Attributed to the source that supplied each field. Treated as claims, not facts.
<p align="center"> <img src="assets/logo.svg" alt="MCPSentinel" width="120" height="120" /> </p> <h1 align="center">MCPSentinel</h1> <p align="center"> Zero-config testing for MCP servers.<br/> Install. Point at your server. Get a full test report. </p> <p align="center"> <a href="https://pypi.org/project/mcp-sentinel"><img src="https://img.shields.io/pypi/v/mcp-sentinel.svg" alt="PyPI" /></a> <img src="https://img.shields.io/badge/python-3.10%2B-green.svg" alt="Python" /> <a href="LICENSE"><img src="https://img.shields.io/badge/license-MIT-orange.svg" alt="License" /></a> </p> --- ## Get Started ```bash pip install mcp-sentinel mcpsentinel "python my_server.py" ``` That's it. No config file. No test code to write. MCPSentinel connects to your server, discovers every tool, generates hundreds of test cases, and prints the results: ``` MCPSentinel v0.1.0 Server: python my_server.py Transport: stdio (auto-detected) Modes: schema, fuzz Output: terminal Discovering tools... 3 tools found Running 47 tests ━━━━━━━━━━━━━━━━━━━━━━ 100% Results: 44 passed, 3 failed, 0 errors ``` --- ## What It Tests MCPSentinel runs two test modes by default: **Schema validation** — sends valid inputs, omits required fields one at a time, tests enum boundaries, type mismatches. **Adversarial fuzzing** — SQL injection, XSS, path traversal, command injection, null bytes, format strings, oversized payloads, unicode stress tests. Every fuzz test expects the server to not crash — returning an error is fine. --- ## Common Usage ```bash # Test your server (zero config) mcpsentinel "python my_server.py" # Schema tests only mcpsentinel "python server.py" -m schema # HTML report mcpsentinel "python server.py" -f html # SSE server (transport auto-detected from URL) mcpsentinel "http://localhost:8001/sse" # Streamable HTTP mcpsentinel "http://localhost:8001/mcp" # Test specific tools mcpsentinel "python server.py" --tools "search_*" # Exclude …
Mapped onto the structured taxonomy from declared text and observed tool names. Confidence shown for derived entries.
Every source is kept verbatim. Field changes are logged as events.