MCP server answers and lists its tools

Sources

• MCP 2025-11-25: lifecycle, Model Context Protocol, November 2025
• MCP 2025-11-25: transports, Model Context Protocol, November 2025
• MCP 2025-11-25: tools, Model Context Protocol, November 2025
• Agentic AI Foundation: MCP joins the Linux Foundation, Linux Foundation, December 2025

What the scanner requests

• /mcp

It also reads documents it has already fetched: $home.

What is measured

The scanner looks for an MCP endpoint in what the scan already holds, in this order: a streamable-http remote in a server card at /.well-known/mcp/server-card.json or a legacy card path the scan requested, a remote in the server card that /.well-known/ai-catalog.json lists, a homepage Link header or <link> whose relation is mcp or mcp-server, and /mcp, which it requests with one plain GET. /mcp counts when it answers 405 with an Allow header that names POST, a JSON-RPC 2.0 message, or an event stream. A 401 does not count, whatever its challenge names: RFC 9728 has every protected resource answer that way. It takes the first endpoint on the measured site: the scanned origin, or the site's host and its subdomains on the same port. An endpoint on another site, an sse remote, a plain HTTP endpoint on an HTTPS site, and a URL with a user name or password are not opened. An endpoint on a subdomain is asked of the removal list first, and one the list names is not requested. With an endpoint, the scan opens one MCP session over Streamable HTTP with at most 3 POST requests: initialize, offering protocol version 2025-11-25 and accepting the version the server answers; the notifications/initialized notification; and tools/list, sent only when the server declares the tools capability. Each later request echoes the Mcp-Session-Id the server issued and sends MCP-Protocol-Version. An answer is read as JSON, or as an event stream whose first message with the request's id is the answer, up to 64 KB. Of the notification's answer only the status and the headers are read. A JSON-RPC result counts only in a 2xx answer. The session has 12 s in all, and it is opened only when the scan has that long left before its deadline, so a slow server never cuts the scan short. No redirect is followed: a 3xx answer is reported as "redirects; not followed", and the check is not measured. The scan never calls a tool and sends no other method: no tools/call, no prompts/get, and no resources/read. It passes when tools/list names at least 1 tool, and the record keeps up to 25 tool names and the protocol version. It partially passes when the server answers 401 with a WWW-Authenticate challenge, so an agent can use it with authorization, or when initialize succeeds and the server lists no tool or declares no tools capability. A partial does not hold level 4 or 5: those levels need a server that lists a tool. It fails when the handshake answers an HTML page, a body that holds no JSON-RPC answer, a JSON-RPC error, or another error status, and an HTML page or an answer with no JSON-RPC result is a defect. It is not measured on 403, 429, a 5xx, a 401 with no challenge, no answer, a redirect, the session's 12 s limit, too little time left in the scan, or a refusal by the scanner's guard, and when the endpoint is on a subdomain the removal list names. It is out of scope when no document names an endpoint the scan opens and /mcp answered without signalling MCP. It is asked only of a site where the scan saw an API or agent surface.

Reproduce it yourself

You do not have to take our word for any of this. Run the same measurement against your own domain:

              ORIGIN=https://example.com
printf 'GET /mcp -> '; curl -sSL -o /dev/null -w '%{http_code} allow=%header{allow}\n' -A 'AgenticWebScore/0.3 (+https://agenticwebscore.com/bot)' -H 'Accept-Language: en' -H 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,text/plain;q=0.8,*/*;q=0.7' "$ORIGIN/mcp"
# The endpoint the record names, or /mcp on the origin.
ENDPOINT="$ORIGIN/mcp"
curl -sS -D - -X POST -A 'AgenticWebScore/0.3 (+https://agenticwebscore.com/bot)' -H 'Accept-Language: en' -H 'Accept: application/json, text/event-stream' -H 'Content-Type: application/json' -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-11-25","capabilities":{},"clientInfo":{"name":"AgenticWebScore","version":"0.3"}}}' "$ENDPOINT"
# The protocolVersion the answer names, and its Mcp-Session-Id header when it sent one.
VERSION=2025-11-25
SESSION=
curl -sS -o /dev/null -w 'notifications/initialized -> %{http_code}\n' -X POST -A 'AgenticWebScore/0.3 (+https://agenticwebscore.com/bot)' -H 'Accept-Language: en' -H 'Accept: application/json, text/event-stream' -H 'Content-Type: application/json' -H "MCP-Protocol-Version: $VERSION" -H "Mcp-Session-Id: $SESSION" -d '{"jsonrpc":"2.0","method":"notifications/initialized"}' "$ENDPOINT"
curl -sS -X POST -A 'AgenticWebScore/0.3 (+https://agenticwebscore.com/bot)' -H 'Accept-Language: en' -H 'Accept: application/json, text/event-stream' -H 'Content-Type: application/json' -H "MCP-Protocol-Version: $VERSION" -H "Mcp-Session-Id: $SESSION" -d '{"jsonrpc":"2.0","id":2,"method":"tools/list","params":{}}' "$ENDPOINT" | grep -o '"name":"[^"]*"' | head -25
            

The fix

This is an example written for example.com. Where the scan can build the fix from your own site, the report shows that version instead.

              {
  "remotes": [
    {
      "type": "streamable-http",
      "url": "https://example.com/mcp",
      "supportedProtocolVersions": [
        "2025-11-25"
      ]
    }
  ]
}
            

Standards referenced

• MCP 2025-11-25

Related checks