The MCP registry certifies nothing, and 41% of servers ship with no auth. Scan any public MCP server in seconds before you wire it into your agent.
See exactly what a caught tool-poisoning looks like — a fictional server with a tool that hides an instruction to steal API keys.
AA healthy server: 13 live tools, clean handshake and transport.
A9 live tools, clean. What "safe to install" looks like.
A poisoned tool description can hijack your agent. An unmaintained server can break it. A "rug pull" can swap safe behavior for malicious after you've trusted it. A directory listing 8,000 servers doesn't tell you which are safe — this does.
Is it actively maintained, archived, or legally murky? Dead servers are a liability.
Does it support authentication and have a way to report vulnerabilities — or neither?
Scans for instruction-like text that signals a tool-poisoning attempt.
A one-time scan tells you a server looks safe today. But servers get updated, and a trusted tool can quietly turn malicious after you have installed it (a "rug pull"). So on a daily schedule, MCPCheck re-scans the servers on its watchlist and records what changed, and the record shows honestly when a server was unreachable and a day came up short. Honest status: loading the live record. Directories that grade thousands of servers tell you how one looks right now; this is a dated record of how it changed.
Every tracked server, re-scanned on a daily schedule, with a dated record of its score, tools, and risks, and an honest note when a run comes up short.
The moment a safe server gains a poisoned tool or changes behavior, it's flagged against yesterday's record.
Anyone can scan a server today. Nobody can retroactively record yesterday. Each day the watchlist runs, the history gets harder to reproduce.
Scanning by hand is free forever. The paid layer is for when your agents need to check servers automatically, at scale, and stay protected as those servers change.
$0
Scan any server on the web. Full report, live tool analysis, embeddable badge. No account.
usage-based
Route your agents' safety checks through our API. One key, metered by calls, so an agent can vet every server before it installs it. Billing in beta — join below.
$19–49/mo
We re-scan the servers you depend on and alert you the moment one changes — catching the "rug pull" a one-time scan can't. Join the waitlist below.
Servers pass review, then silently mutate. Drift-watch re-scans the servers you depend on every version bump and alerts you the moment something changes. Join the waitlist.