# MCP Checkup

> Continuous protocol contract testing for MCP servers. We find public MCP servers, run 15 checks against the protocol itself, and publish results as signed evidence (the verifying public keys are published at https://mcpcheckup.com/.well-known/mcpcheckup-keys.json); a run that was not signed is shown as an unsigned observation. Every check lands in one of four states: VERIFIED, FAILED, OBSERVED_RISK, UNVERIFIED. There is never a score, and a check that wasn't run is never shown as one that passed.

## Start here

- [Directory of observed servers](https://mcpcheckup.com/servers): search by server name, endpoint address or domain, tool name, or tool description; sort order is never affected by payment.
- [Methodology](https://mcpcheckup.com/methodology): what each check does, the four states, and how to verify a signed attestation yourself.
- [Try a check on any public endpoint](https://mcpcheckup.com/): one unsigned, on-demand run; the result page expires in 24 hours.
- [MCP servers in numbers](https://mcpcheckup.com/servers/stats): Daily counts across the MCP servers we observe: check results, protocol revisions, tool set changes. Counts only. This page does not evaluate any server.

## For agents

- [Connect to our MCP endpoint](https://mcpcheckup.com/agents): the endpoint address, setup steps for ten clients, and the six available tools.
- MCP endpoint: https://mcpcheckup.com/mcp (Streamable HTTP). Tools include check_mcps and get_mcp_report, so an agent can look up a server before calling it.
- Rate limit: about 20 requests per minute per IP address, counted per Cloudflare location; a 429 response carries Retry-After. No authentication and no paid tier for this endpoint.
- Report pages are at https://mcpcheckup.com/check/{provider}/{server}. Signed attestations are at https://mcpcheckup.com/attestations/{id}.

## For maintainers

- [Why claim your server](https://mcpcheckup.com/maintainers): an unclaimed server is checked every 12 hours. Claiming turns on 8-hour checks, a README badge, and alert emails. Proving control is a DNS record or a well-known file; we never ask for credentials.
- [Pricing](https://mcpcheckup.com/pricing): Free and Indie. Paying changes how often we check and what the badge shows; it never changes what the checks say.
- [About our probe](https://mcpcheckup.com/probe): user agent, request budget, and how to opt out.

## Optional

- [Blog](https://mcpcheckup.com/blog)
- Selected posts: [Claiming an MCP server page: we verify the address, not the record](https://mcpcheckup.com/blog/verified-against-the-address), [What a signed attestation proves, and what it does not](https://mcpcheckup.com/blog/what-a-signed-attestation-proves), [The homepage check leaves no trace in the directory](https://mcpcheckup.com/blog/the-homepage-trial-leaves-no-trace)
- [About](https://mcpcheckup.com/about)
- 中文: https://mcpcheckup.com/zh/