Safe on any server, private on yours

A tester that might break the thing it tests, or send your data somewhere, is not one anyone should run. Here is exactly what QAmcp touches, where your login goes, and what it never does. It's open source, so you can check every line.

Only the server you give it

Your server, and its login pageQAmcp sends requests to the server you name, and to its login service if it has one. That's the whole list.

No AI, no tracking, no telemetryThe free tool calls no AI service and reports nothing back to us. There's no account and nothing to sign up for.

Reports stay on your computerThe score is printed in your terminal. Files like report.html or report.json are written only where you ask, and uploaded nowhere.

Keys go only to your serverA key you add with --header is sent to the server you're testing and nowhere else. QAmcp never writes it into a report.

It never runs a tool that could change something

A tool's safety label is the server's own word, so QAmcp checks it against what the tool's name and description say before running anything.

By default: read-only tools onlyOnly tools the server labels read-only, and whose name and description agree. Everything else is skipped, and the report lists each skipped tool and why.

Destructive-sounding tools: neverA tool named like delete_account or drop_table is never run, in any mode.

Harmless inputsEach safe tool gets one sensible sample input, then a missing input and a wrong-type input, to see if it refuses them clearly.

Don't trust the server? Run nothing--look-only calls no tools at all. It only reads the tool list, descriptions, labels and login setup.

A program on your computerWith --stdio, QAmcp starts the program once more for a moment, to check it prints only MCP messages. The report says it did.

More only when you ask--owner and --run-unlabeled run more tools, for your own server or a test copy. You choose; QAmcp never decides that for you.

Your password never reaches QAmcp

You sign in on the server's own pageWith --login, your browser opens the service's real login page. You type your password there, not into QAmcp.

QAmcp gets a temporary passAfter you approve, the service hands QAmcp a pass for this server, the way it would any AI app you connect.

Kept on your computer onlyThe pass is saved in a .qamcp folder where you ran the test, so you don't log in every time. On Mac and Linux only your user can read it.

It can't be committed by accidentThat folder tells git to ignore it, so a login saved inside a project never ends up in your repository.

To log out, delete the .qamcp folder. You can also revoke the pass on the service's own settings page, like any connected app.

No tracking here either

This websiteNo analytics, no cookies, no ads. The fonts are served from this site, so your visit isn't reported to anyone else.

When we test public serversWe test new servers from the official MCP Registry in the same safe mode, and send the results to their owners. Those report links are unlisted and hidden from search engines.

Open source, MIT licensedEvery check is in the code on GitHub. Read it before you trust it.

Found a problem?If QAmcp gets something wrong about your server, or does something it shouldn't, tell us on GitHub. Being fair matters more than anything.

Safe on any server, private on yours

Only the server you give it

It never runs a tool that could change something

Your password never reaches QAmcp

No tracking here either

Start with a look that touches nothing