Tools / MCP Probe
MCP Server Probe
Check an MCP endpoint's reachability, authentication posture, and tool disclosure — from your browser. For servers that block cross-origin requests, copy the curl commands and run them locally.
Use responsibly: probe only servers you own or are authorized to test. This tool sends a standard MCP initialize handshake — nothing more.
Tries /mcp, /sse, and the URL you entered.
// About this tool
MCP Server Probe
The Model Context Protocol (MCP) is how AI agents connect to tools and data — and thousands of MCP servers have been found exposed on the internet with no authentication. This probe answers three questions about an endpoint: is it reachable, does it require authentication, and does it disclose its tools?
It sends a standard MCP initialize handshake — the same request any MCP client makes — and reports the HTTP status and whether the server requires auth. It also attempts tools/list when the handshake succeeds, so you can see what a server is willing to disclose.
Browsers enforce same-origin policy, so servers without permissive CORS headers will block the in-browser request. That result is ambiguous, not a finding — the tool falls back to copyable curl commands you can run from your own machine, which is how most real probes happen anyway.
Use it only against servers you own or are explicitly authorized to test. A handshake is harmless, but probing someone else's infrastructure without permission is not.
// When to use it
Audit your own MCP deployments
Check that every MCP server you expose is reachable, requires authentication, and discloses only the tools you intend.
Check an endpoint before trusting it
Verify a third-party MCP server's posture before wiring it into an agent with elevated permissions.
Confirm a handshake works
Debug an MCP integration by confirming the initialize handshake succeeds and seeing what the server reports about itself.
// Questions
What does the probe actually send?
A standard MCP initialize JSON-RPC request — the same handshake any MCP client performs. It does not call any tools or modify anything.
Is this a vulnerability scanner?
No. It checks reachability, authentication posture, and tool disclosure — the baseline questions you'd ask of any endpoint. It does not exploit anything.
Why is my probe CORS-blocked?
Browsers enforce same-origin policy, so servers without permissive CORS headers will reject in-browser requests. That tells you nothing about the server — use the copyable curl commands to probe from your machine instead.
Can I probe any server on the internet?
Technically yes, but you should only probe servers you own or are authorized to test. Probing someone else's infrastructure without permission can be a legal issue.
// Related tools