QAmcp GitHub
How QAmcp sees a broken serverOur own test server, broken on purpose · 38/100 · FAIL
Drawing of the test server: it connects and lists 9 tools. 3 tools are outlined in red for problems, 4 are dashed because QAmcp did not run them. Five numbered callouts point at the problems listed beside the drawing. connect tool list · 9 tools TOOLS get_weather fetch_notes slow_report search_users strict_lookup delete_account list_projects team_digest get_or_create_user error messages 1hidden instruction 2never answers 3no description 4not marked dangerous 5password leaked

Test any MCP server in one command.

QAmcp connects to your server the way an AI app does, checks every tool, and draws you exactly where it breaks.

Paste your server link, then copy · nothing to install
  • Free and open source
  • Never runs tools that could change data
  • Sends nothing anywhere but your server; logins stay on your computer

Found on this serverFull report →

1fetch_notes hides an instruction telling the AI to read your SSH key
2slow_report never answers, even to bad input
3slow_report has no description, so the AI has to guess
4delete_account isn't marked dangerous. Dashed boxes weren't run, on purpose.
5search_users shows a database password in an error
FOR TEAMSPublish a server for customers? Check it on every change
SHEET1 of 4 · v0.1.5 · MIT
Sheet 2 of 4 · What it checks

Every check is a plain fact you can verify.

No AI judges anything. Every result is pass or fail, a time in milliseconds, or an exact match, and the report always says what it could not test.

CheckWhat it meansOn the test server
No hidden instructionsTool descriptions don't smuggle orders to the AI, invisible characters, or tricks.Failed: fetch_notes
No secrets leakedError messages don't show passwords, keys, tokens or internal file paths.Failed: search_users
Tools work with good inputsEach safe tool answers in time with something real.Failed: slow_report
Bad inputs give a clean errorMissing or wrong-type inputs get a clear refusal, not a hang or a crash.Failed: slow_report
Every tool is describedDescriptions and inputs explain themselves, and no two tools read the same.Failed: slow_report
Tools are labeled safe or dangerousRead-only and destructive labels exist, and match what the tool's name says.Advisory: delete_account
Fast enoughConnecting, listing and answering, timed.Advisory: search_users, 3.0 s
Login setup follows the specAn AI app can find your login and sign in the way the MCP rules describe.No login on this server
Resources and prompts workWhat the server offers besides tools opens cleanly.None offered
Tools work togetherAn ID one tool returns is accepted by the next tool, the way AI apps chain them.No chains on this server
Ready for the newest MCP versionProtocol version and transport, checked against the current spec.Advisory: older version
Sheet 3 of 4 · The report

A report page you can send to anyone.

Add --html report.html and QAmcp writes one file: the score, every failure and advisory, everything it did not run and why. It opens offline, on any computer.

Context7 was tested independently on 15 Oct 2026, the same way anyone can. QAmcp is not affiliated with Upstash or Context7.

Server behind a login? Add --login. Its own login page opens in your browser, and the login stays on your computer.

A program on your computer, not a link? Use --stdio "npx -y your-server".

The report page for the broken server: score 38 out of 100, FAIL, with six failures and ten advisories listed.
Sheet 4 of 4 · For teams

Publish a server for customers? Check it on every change.

When your MCP server breaks, your customers' AI agents break with it. QAmcp runs in GitHub on every pull request, comments with the score, and fails the build if the server got worse or a tool disappeared.

  • Never runs risky toolsOnly tools labeled read-only, whose names and descriptions agree.
  • Sends nothing elsewhereNo tracking, no account, no AI. Only your server hears from it.
  • Your login stays yoursYou sign in on your server's own page; nothing is stored anywhere else.
  • Open sourceMIT licensed. Read every check before you trust it.
# .github/workflows/qamcp.yml
on: pull_request
jobs:
  qamcp:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: QAmcp/qamcp-cli@v0
        with:
          url: https://your-server.com/mcp
          fail-under: 80

Try it on your server now.