Free local diagnostic
Check a remote MCP endpoint without sharing a token.
This small Bash tool sends only unauthenticated discovery and initialize requests. It records transport evidence, redirects, response types, and OAuth protected-resource metadata in one redacted report.
Version 1.0.0
Inspect first. Run locally.
The script refuses cleartext remote URLs, rejects credentials in URLs, redacts session and cookie headers, and removes its temporary files when it exits.
Run it
curl -O https://agent-rescue-desk.netlify.app/mcp-endpoint-check.sh
less mcp-endpoint-check.sh
bash mcp-endpoint-check.sh https://your-server.example/mcpDo not place a bearer token, password, key, or user information in the URL. The tool intentionally does not accept credentials.
What the report distinguishes
- No response: DNS, TLS, proxy, firewall, or egress layer
- Redirect: non-canonical URL or cross-host authorization risk
- 401: reachable protected resource and OAuth discovery evidence
- 403: authenticated identity, allowlist, audience, or permission layer
- 404/405: wrong path or wrong transport endpoint
- 2xx with the wrong media type: transport contract mismatch
What it does not do
It does not log in, call a business tool, bypass a gateway, or prove the complete workflow. After the transport layer passes, use the official MCP Inspector for authenticated discovery and a minimal direct tool call, then verify the final client-visible outcome.
Why protected-resource metadata matters
A protected MCP server can advertise a metadata URL through
WWW-Authenticate. That document identifies the
authorization server, resource, and supported scopes. A missing,
cross-host, or mismatched value can make OAuth fail before the MCP
tool itself is ever reached.
The checker derives the metadata URL using RFC 9728 and reports the status and media type without printing the document body.
Still broken after the direct checks?
Submit the evidence for a fixed-scope fit review.
Agent Rescue Desk repairs one bounded agent workflow or delivers an actionable root-cause package for a fixed $1,000.