Frequently asked questions
What does MCP Checkup do?
MCP Checkup runs continuous, automated protocol-contract and reachability checks against MCP servers, and publishes results as signed evidence; a run that was not signed is shown as an unsigned observation instead. We check what we can independently observe from the outside, on a schedule, against a live endpoint. We do not audit source code, we do not guarantee an endpoint's behavior between our runs, and a clean report is not a guarantee — it's a record of what was checked and what was seen at the time it was checked.
Does MCP Checkup run my code?
We do not execute maintainers' code on our infrastructure. No business tool is ever called. Stdio-only packages are out of scope, because checking them would mean running your code, and we don't.
Why MCP Checkup doesn't run your code (and what that means for stdio servers)
Why doesn't MCP Checkup give servers a score?
Every check lands in one of four states, and a check that wasn't run is never shown as one that passed. A server with twelve verified rows and one failed row is not "92%". A verdict would claim more than the evidence supports.
What does "observed, unsigned" mean?
A report page marked "observed, unsigned" means MCP Checkup ran its checks against your server and is showing exactly what it saw — but no signed attestation is attached to the run yet, so there's nothing for a third party to independently verify. This happens when the run's attestation was disqualified for a stated reason (shown on the page), or when the run carries no attestation at all. It has nothing to do with whether the target is claimed: signing works the same whether or not anyone has claimed the target.
What does a signed attestation prove, and what does it not prove?
It proves exactly this: on this date, our probe, running this specific code, observed these things about this endpoint, and nobody has altered the record since. It does not prove the server is good. It does not prove anything about what the tools do when called, because we never call them.
How often does MCP Checkup check a server?
Unclaimed servers are probed every 12 hours. Once claimed, a server is probed every 8 hours on the Free plan and every 15 minutes on Indie. Each target's report page shows which cycle it is currently on.
I never registered my server. Why is it in the directory?
We find public MCP servers and check them every 12 hours — nobody has to sign in, and nobody has to ask. The result is a public page for each one. Public endpoints listed in MCP registries, plus a short hand-picked set, are checked automatically without their operators signing up, so the directory has real data.
Your MCP server may already be in a directory you never signed up for
How do I claim my server? Do I have to give you a password or a key?
Add a DNS TXT record, or serve a .well-known file, containing the token we give you. You'll need to sign in with your email — there is no password. We never ask for credentials.
Claiming an MCP server page: we verify the address, not the record
How do I get my server removed and the checks stopped?
Email support@mcpcheckup.com and we will stop every check of that endpoint. The server is removed from the directory, and its report and attestation pages return 404 from then on. Signed records already issued are kept with their content and signatures unchanged: in our database for at least 30 days, then in cold storage; we no longer publish them.
Does a check from the homepage leave a record?
Not in the directory: it is not signed, it is not stored as a run, and it does not create a report page. We record the check as a tracking request — inclusion is not guaranteed — and keep the record and the result for 30 days. The result page is shown for 24 hours.
What does MCP Checkup keep about me, and for how long?
If you sign in: your email address, the times you signed in, and the targets you add, kept for as long as the account is open. Records of calls to our MCP endpoint are deleted after 90 days and records of on-demand checks after 30 days; daily call totals are kept without an end date. Database backups made before 2026-10-02 may still contain some of these records; the privacy notice has the details.
Can I pay for a better result?
Paying changes how often we check and what the badge shows; it never changes what the checks say. Claiming a server and signing in changes how often it's checked and what you can configure — it doesn't change what's true about the server.
What is the difference between the Free and Indie plans?
Every tier runs the same 15 protocol checks, with the same signed attestations. Once claimed, a server is probed every 8 hours on the Free plan and every 15 minutes on Indie. Indie covers 10 targets per subscription instead of 1, and adds the live badge — a state plus a timestamp.
What if a check result looks wrong?
See each report page's own coverage summary for exactly what ran and what didn't, on that run. To report a check result that looks wrong, email support@mcpcheckup.com.
How do I put a badge in my README?
On your server's report page, the "Get badge" block gives you Markdown and HTML to show this target in your README. Free tier: a static "claimed" badge — it never shows a status. Indie tier: renders the real result of the most recent check when that check is fully signed.
Is MCP Checkup the same as the npm package mcp-checkup?
No: MCP Checkup is the website at mcpcheckup.com and its MCP endpoint at mcpcheckup.com/mcp. None of our packages is published on npm. The check suite behind mcpcheckup.com is public at github.com/mcpcheckup/checks.