Analyze an MCP server
Paste your server's tools/list (or your tool definitions) for a secure-by-default self-check: token cost, risky descriptions (tool-poisoning, secrets), least privilege, missing validation. Everything runs in your browser — nothing is sent, no code is executed.
This is triage, not a verdict. Reading descriptions proves nothing about real behavior (MCP Hub product rule). For a security verdict, run the behavioral pentest — it, and only it, is authoritative.
input · tools/list (JSON)
next
Clean here? That's only the pre-flight. Claim your server on the creator space and run the behavioral pentest to earn the "Verified" badge. See also the secure-by-default guide and the reference skeleton.