QAmcpTest another server

Test certificate: our test login serverhttp://127.0.0.1:4311/mcp

Server
Not reported
MCP version
Behind the login
Tested
2026-10-16 · 18:17 UTC
Safety mode
Only tools labeled read-only were run
Logged in
No
Tester
QAmcp 0.1.8
Result
Login setup checked · 10 checks behind the login

This server needs a login, so only the login setup could be checked from outside. A login wall is not a fault, so nothing is scored. The command below tests everything behind it.

Failures: fix these first 0

Nothing failed.

Advisories: worth fixing 0

No advisories.

All test items

Open an item to see every result behind it.

T-1ConnectsReached the server. It asks for a login before anything else, which is normal and not a fault.NEEDS LOGIN

Reached the server. It asks for a login before anything else, which is normal and not a fault.

T-2Login setup follows the specThe server asks for a login (it answers 401 to an anonymous request).PASS
T-2.1

The server asks for a login (it answers 401 to an anonymous request).

T-2.2

The 401 reply points AI apps to the login details (resource_metadata).

T-2.3

The login details name this exact server.

T-2.4

Found the login server's description at http://127.0.0.1:4311/.well-known/oauth-authorization-server.

T-2.5

The login server's name matches what the server points to.

T-2.6

PKCE with S256 is supported.

T-2.7

AI apps can register themselves (dynamic registration).

T-3Ready for the newest MCP versionBehind the login, so not tested yet. It counts neither for nor against the server.NEEDS LOGIN

Behind the login, so not tested yet. It counts neither for nor against the server.

T-4Lists its toolsBehind the login, so not tested yet. It counts neither for nor against the server.NEEDS LOGIN

Behind the login, so not tested yet. It counts neither for nor against the server.

T-5Every tool is describedBehind the login, so not tested yet. It counts neither for nor against the server.NEEDS LOGIN

Behind the login, so not tested yet. It counts neither for nor against the server.

T-6Tools are labeled safe or dangerousBehind the login, so not tested yet. It counts neither for nor against the server.NEEDS LOGIN

Behind the login, so not tested yet. It counts neither for nor against the server.

T-7No hidden instructionsBehind the login, so not tested yet. It counts neither for nor against the server.NEEDS LOGIN

Behind the login, so not tested yet. It counts neither for nor against the server.

T-8Tools work with good inputsBehind the login, so not tested yet. It counts neither for nor against the server.NEEDS LOGIN

Behind the login, so not tested yet. It counts neither for nor against the server.

T-9Bad inputs give a clean errorBehind the login, so not tested yet. It counts neither for nor against the server.NEEDS LOGIN

Behind the login, so not tested yet. It counts neither for nor against the server.

T-10Fast enoughBehind the login, so not tested yet. It counts neither for nor against the server.NEEDS LOGIN

Behind the login, so not tested yet. It counts neither for nor against the server.

T-11No secrets leakedBehind the login, so not tested yet. It counts neither for nor against the server.NEEDS LOGIN

Behind the login, so not tested yet. It counts neither for nor against the server.

T-12Resources and prompts workBehind the login, so not tested yet. It counts neither for nor against the server.NEEDS LOGIN

Behind the login, so not tested yet. It counts neither for nor against the server.

Test everything behind the login

One command runs every check above on the real tools. Nothing to install: npx downloads QAmcp and runs it (needs Node.js 20 or newer).

npx qamcp-cli http://127.0.0.1:4311/mcp --login --html report.html

Your browser opens the server's own login page. Your login stays on your computer and goes only to the server. The full report is saved as report.html in the folder you ran it from. Free and open source.