Free, no signup
MCP server validator
Paste a remote MCP endpoint. The validator checks protocol compliance and the tool definitions that agents read: names, descriptions, arguments, and safety hints. You get a grade from A to F and a fix for every finding, ready to give to your coding agent. It never calls a tool.
Public endpoints only. Behind a sign-in, the validator checks only the sign-in discovery. To grade the tools behind it, use the CLI: canary inspect URL --bearer-env VAR.
What the validator checks
Protocol compliance
The negotiated MCP version against the newest one, and what each newer revision adds. ping, a -32601 answer to an unknown method, the tools capability, cache hints on tools/list (2026-07-28), the legacy SSE transport, and the OAuth sign-in discovery.
Tool definitions
Missing, thin, or very long descriptions. Arguments without a type or a description, required names that do not exist, invalid or duplicate tool names, a missing readOnlyHint, conflicting hints, and missing output schemas.
Server
Server name and version, the instructions text, an empty tool list, more than 40 tools, a tool list larger than about 10,000 tokens, and no read-only tool at all.
The grade. The score starts at 100. An error takes 15 points and a warning 5; notes take nothing. One rule takes at most 20, so ten tools without a hint do not give an F. A is 90 or more, B 75, C 60, D 40, and anything lower is F.
Questions
How is this different from the MCP Inspector?
The Inspector is interactive: you connect, pick a tool, and call it. The validator calls no tool. It reads what the server tells agents, makes a few protocol requests, and judges the result against the MCP specification, with a fix for each finding.
Does it change anything on my server?
No. Besides the handshake and tools/list, it sends only a ping (versions before 2026-07-28) and one unknown method, mcpcanary/unknown-method, to check the error answer. Requests carry the MCPCanary User-Agent.
Which MCP versions does it know?
Every published revision from 2024-11-05 to 2026-07-28. A server on an older version gets a note or a warning that lists what each newer revision adds.
How do I fix the findings?
Each finding has a fix and often a JSON example. Under the report, “Fix it with your coding agent” puts all findings into one prompt for the agent that works on the server code. After the deploy, open the same link again to see the new grade.
Can I run it in CI?
Yes. canary inspect URL --json returns the same report as agent_readiness, with grade, score, and findings. The report never changes the exit code, so fail the build on the grade yourself, for example with jq.
Is a valid server a working server?
No. A server can pass every check while the database behind its tools is down. Use the MCP server tester to see if it is up now, and a monitor to call a real tool on a schedule and email you when it breaks.