MCP server checker
Paste the URL of a remote MCP server. The checker talks to it the way Claude or ChatGPT would and tells you what works, what is missing, and how to fix it.
Example report: dawloom.com/mcp
This is a real run against our own public MCP server, checked 2026-10-13 with a local copy of the checker, so the times come from a development machine. Grade:pass, in 239 ms. Server dawloom-tools 2.0.0, Streamable HTTP, protocol 2026-07-28 (modern), also 2025-11-25, 2025-06-18, 2025-03-26, 2 tools, 395 bytes of input schema.
| Result | Check | What the checker saw |
|---|---|---|
| pass | Server answers over HTTPS | First answer was HTTP 200. |
| pass | Transport | Streamable HTTP, stateless requests (2026-07-28 style). |
| pass | Handshake | server/discover answered in 125 ms. |
| pass | Protocol version | Supports 2026-07-28, 2025-11-25, 2025-06-18, 2025-03-26. |
| pass | Server info | dawloom-tools 2.0.0, 580 characters of instructions. |
| pass | tools/list | 2 tools: convert_document and list_supported_formats. |
| pass | Tool schemas | Input schemas total 395 bytes. Every tool has a description. |
| info | Authentication | No token needed. Anyone with the URL can call this server. |
| skip | Protected resource metadata | Not needed. The server does not ask for a token. |
| skip | Authorization server metadata | Not needed. The server does not ask for a token. |
| pass | CORS for browser clients | Preflight allows origin * and the MCP headers. |
| pass | Response time | First answer in 125 ms. |
| pass | Error shape: unknown method | JSON-RPC error -32601 with HTTP 404. |
| pass | Error shape: malformed JSON | JSON-RPC error -32700 with HTTP 400. |
What it checks
Transport
Is it Streamable HTTP in the 2026-07-28 style, Streamable HTTP with the older initialize handshake, or only the deprecated HTTP+SSE transport?
Handshake and version
Does server/discover or initialize return a result, and which protocol versions does the server speak?
Server info
Does the server send a name, a version, and instructions that clients can show?
tools/list
How many tools, their names, and how many bytes of input schema they add to every prompt.
Auth
On a 401: is there a WWW-Authenticate header with resource_metadata, is the protected resource metadata (RFC 9728) published, and does the authorization server metadata list S256 PKCE and a way to register?
CORS
Can a web page on another origin call it? This matters only for browser-based clients.
Error shapes
Does an unknown method get JSON-RPC -32601, and does broken JSON get -32700, instead of an HTML error page?
Response time
Time to the first answer and to tools/list, measured from a Cloudflare data center.
Each check, why it matters, and the usual fix are explained inMCP server checker: test any remote MCP server in your browser.
For agents and scripts
The same check is a free API. No key. 10 checks a minute per IP. A server that fails still returns 200 with a failing report. A 4xx means the URL itself was refused.
curl -X POST https://dawloom.com/api/v1/mcp-check \
-H "Content-Type: application/json" \
-d '{"url":"https://dawloom.com/mcp"}'Schema: /api/v1/openapi.json(operation checkMcpServer). Docs: developer portal.
Questions clients ask
Short answers, no sales language. If yours isn't here, ask an engineer directly.
Ask us anythingIs my MCP server working if it passes here?
It means a client can reach it over the public internet, finish the handshake, list tools, and get clean errors. It does not call your tools, so it cannot tell you a tool returns the right data. Test tool calls with the MCP Inspector or in Claude or ChatGPT.
Why does the check run on your server and not in my browser?
Browsers block requests to other sites unless that site sends CORS headers, and most MCP servers don't. So the checker runs in our Cloudflare Worker. It accepts only public https URLs, refuses private and internal addresses, sends no cookies and no token, and stores nothing.
Can it test a server that needs a login?
It tests everything up to the login: the 401, the WWW-Authenticate header, and both OAuth metadata documents. It never sends a token, so it cannot list the tools behind the login.
Can I call it from a script or an agent?
Yes. POST {"url":"https://example.com/mcp"} to https://dawloom.com/api/v1/mcp-check. No key. The limit is 10 checks a minute per IP. The response schema is in the OpenAPI document.
Can it test a local server on localhost?
No. Localhost, private networks, and cloud metadata addresses are blocked on purpose. Expose a test server with a tunnel and check the public https URL, or use the MCP Inspector locally.
Need an MCP server built?
We run a public MCP server at dawloom.com/mcp and build MCP servers for businesses at a fixed price. An engineer replies, not a sales team.