Audit MCP servers for install-time issues before you install them.
Wellknown found it in public sources; nobody has proven control of it yet. Claiming takes one click if the repository is under your GitHub account, or a small file on your domain otherwise. Verified owners get the badge, 15-minute checks, status alerts, edits that outrank crawled data, and a ranking boost.
Agents can do it too: POST https://wellknown.network/api/v1/claims with {"agent":"mcp-server-audit","method":"well_known_file"} — machine-readable steps at claim.json, guide at /docs/claim.
Everything here was measured by our prober or read from a registry. Nothing is self-reported.
Attributed to the source that supplied each field. Treated as claims, not facts.
# mcp-audit Audit MCP servers for install-time issues before you install them. `mcp-audit` is a CLI utility that runs a set of install-time validation checks against any [Model Context Protocol](https://modelcontextprotocol.io) server, so you can see the problems before you wire the server into your agent config and lose an afternoon debugging silent failures. **Status:** v0.1 alpha. Install-time validation only. Security-boundary check lands in v0.2, runtime spec-compliance in v0.3. See "Roadmap" below. ## The problem MCP is a fast-growing ecosystem - thousands of servers exist across public directories, community registries, and internal deployments. Quality varies wildly. If you have installed more than a handful, you have hit one of: - Manifest / init response missing required fields; agent client refuses to load. - Server declares tools in its `capabilities` but `tools/list` returns method-not-found. - Tool `inputSchema` is not valid JSON Schema; agents pass malformed args and the tool crashes at call time. - Server hangs on `initialize`; agent times out silently and the tool disappears from your session. `mcp-audit` runs 4 checks in about a second and tells you which of these the server has before you install it. ## Install ```bash pip install mcp-server-audit ``` Requires Python 3.10+. The PyPI package name is `mcp-server-audit`; the CLI command is `mcp-audit`. ## Use ```bash mcp-audit "python -m my_mcp_server" mcp-audit "npx -y @modelcontextprotocol/server-filesystem /tmp" mcp-audit "uvx some-mcp-server" --json mcp-audit "node build/index.js" --timeout 60 --verbose ``` The single positional argument is the shell-style command that spawns the MCP server over stdio. `mcp-audit` will launch the subprocess, run the handshake, probe `tools/list` / `resources/list` / `prompts/list`, run its 4 checks, and close the server cleanly. Default timeout is 30 seconds per request. For `npx -y` cold-cache first runs (which can take 20-60s to download + start…
Mapped onto the structured taxonomy from declared text and observed tool names. Confidence shown for derived entries.
Every source is kept verbatim. Field changes are logged as events.