The MCP registry certifies nothing, and 41% of servers ship with no auth. Scan any public MCP server in seconds before you wire it into your agent.
See exactly what a caught tool-poisoning looks like — a fictional server with a tool that hides an instruction to steal API keys.
AA healthy server: 13 live tools, clean handshake and transport.
A9 live tools, clean. What "safe to install" looks like.
A poisoned tool description can hijack your agent. An unmaintained server can break it. A "rug pull" can swap safe behavior for malicious after you've trusted it. A directory listing 8,000 servers doesn't tell you which are safe — this does.
Is it actively maintained, archived, or legally murky? Dead servers are a liability.
Does it support authentication and have a way to report vulnerabilities — or neither?
Scans for instruction-like text that signals a tool-poisoning attempt.
A one-time scan tells you a server looks safe today. But servers get updated — a trusted tool can quietly turn malicious after you've installed it (a "rug pull"). So every day, MCPCheck re-scans and records what changed. Over time that becomes something no one can copy: the trust record of the entire MCP ecosystem.
Every tracked server, re-scanned every day, with a dated record of its score, tools, and risks.
The moment a safe server gains a poisoned tool or changes behavior, it's flagged against yesterday's record.
Anyone can scan a server today. No one can go back and record the past. The history compounds into the moat.
Scanning by hand is free forever. The paid layer is for when your agents need to check servers automatically, at scale, and stay protected as those servers change.
$0
Scan any server on the web. Full report, live tool analysis, embeddable badge. No account.
usage-based
Route your agents' safety checks through our API. One key, metered by calls, so an agent can vet every server before it installs it. Billing in beta — join below.
$19–49/mo
We re-scan the servers you depend on and alert you the moment one changes — catching the "rug pull" a one-time scan can't. Join the waitlist below.
Servers pass review, then silently mutate. Drift-watch re-scans the servers you depend on every version bump and alerts you the moment something changes. Join the waitlist.