Your agent added an MCP server by itself. What do you actually know about it?

Personal agents such as Hermes, OpenClaw and Muse can set up their own tools. Ask one to connect to an MCP server and it will often do it without anyone opening a settings screen. We tried it with our own server: we gave a personal agent the address and asked it to add the server. It did, in one step.

That is convenient. It also removes the moment when a person used to look before connecting. So sooner or later the question comes up: should my agent be talking to this server at all?

What no one can tell you from the outside

An MCP server is a program someone else runs. What it does with the arguments your agent sends, what it keeps, who operates it: none of that is visible to anyone outside. A label or a number that claims to settle the question is a guess about something its author cannot see. That is why we never give one.

What can be checked

Some things are visible to anyone who connects, and we record them on a schedule for every public server in our directory: 1,470 servers as of 2026-10-01 00:12 UTC.

• Whether it answers, and which protocol revision it speaks.
• Which tools it offers, and the exact shape of their inputs. We record a fingerprint of the tool list every time.
• Whether those tools changed since the last time we looked.
• Signals in tool names and descriptions, the text your agent reads before it decides what to call: invisible characters, sentences addressed to the assistant instead of describing the tool, imitation system markers, markup a renderer could execute, unusually long descriptions. Among the 1,006 servers whose latest result is signed, 84 showed at least one of these signals in that result. A signal is something we saw, not a judgement about intent; many have ordinary explanations.

Every check lands in one of four states: verified, failed, observed risk, or unverified with a stated reason. They are never added up into a single number.

Why change matters most for an agent

When you approve a server for your agent, you approve the tools it offers that day. A server can change its tool list at any time. Whether your client asks you again depends on the client.

In the 30 days up to 2026-10-01, 236 of the 1,470 servers in our directory changed their tool set at least once: two consecutive observations of the same server produced different tool set fingerprints. Most changes are routine, such as a new option or a renamed tool. But a server you added for weather lookups could, a month later, also offer a tool that sends email, and your agent would see it the next time it lists tools.

What we provide

Our own MCP server lets your agent ask before it connects, or before it calls a server it added a while ago.

• check_mcps looks up a server by name, endpoint address or domain and returns what we observed in its latest run.
• get_mcp_report returns every check with its state, plus the tool list we observed.
• get_mcp_history shows recent tool set changes.
• get_attestation returns the signed attestation, when the result has one.

These tools answer only from what we have already recorded. They never contact the server you are asking about. There is no account and no key.

The quickest way to connect is to tell your agent: “Read https://mcpcheckup.com/agents and add the MCP Checkup server.” That page also has the steps for ten clients.

What it will never tell you

It will not tell you that a server is fine to use. It tells you what was observed, when, and by which version of our checks, and leaves the decision with you and your agent.

If you maintain an MCP server, it may already be in our directory. Claiming it turns on 8-hour checks, a README badge, and alert emails.