Agent readiness tools

MCP server tester

Q: How do these checks count in the score?

mcp-server is in the web-standards part: 70% of the score, and the one part whose checks hold a level. mcp-card is an unscored check: 0 points. It never fails and never holds a level. The methodology says what each state earns.

Enter a domain to find the MCP server it names. The scan opens one session with it, asks for its tools, and reads its server card.

The MCP server tester runs the full scan of 60 checks, not one request. The five exemplar scans of 20 October 2026 sent 29 to 89 requests each and took 3 to 8 seconds. A scan that reaches its 60 s deadline is reported as not measured.

A stored result: cloudflare.com, measured on 20 October 2026. Its report opens on the same panel yours will.

What is checked

The report opens on 2 checks of rubric v0.9. Each is described here in the rubric's own words.

MCP server answers and lists its tools

An agent given the address of an MCP server can call its tools. The scan opens one session to see that the server answers and what it offers.

mcp-server is a scored check. Web standards: 70% of the score. A check in it can hold a level.

The scanner looks for an MCP endpoint in this order: a streamable-http remote in a server card at /.well-known/mcp/server-card.json or a legacy card path the scan requested, a remote in the server card that /.well-known/ai-catalog.json lists, a homepage Link header or <link> whose relation is mcp or mcp-server, and /mcp, which it requests with one plain GET. /mcp counts when it answers 405 with an Allow header that names POST, a JSON-RPC 2.0 message, or an event stream. A 401 does not count, whatever its challenge names: RFC 9728 has every protected resource answer that way. It takes the first endpoint on the measured site: the scanned origin, or the site's host and its subdomains on the same port. An endpoint on another site, an sse remote, a plain HTTP endpoint on an HTTPS site, and a URL with a user name or password are not opened. An endpoint on a subdomain is asked of the removal list first, and one the list names is not requested. The card the AI catalog lists may be on a subdomain of the site, on the same port. So may a card that a server card lists with the media type application/mcp-server-card+json. The scan requests one such card with one GET and the JSON Accept header, and reads its remotes. It does so only when no source before the card names an endpoint the scan opens. The removal list is asked about the card's host first, and a host it names is not requested. An endpoint in that card counts as found through the catalog or the server card that lists it. A card on another site, and a plain HTTP card on an HTTPS site, are not requested. With an endpoint, the scan opens one MCP session over Streamable HTTP with at most 3 POST requests: initialize, offering protocol version 2025-11-25 and accepting the version the server answers; the notifications/initialized notification; and tools/list, sent only when the server declares the tools capability. Each later request echoes the Mcp-Session-Id the server issued and sends MCP-Protocol-Version. An answer is read as JSON, or as an event stream whose first message with the request's id is the answer, up to 64 KB. Of the notification's answer only the status and the headers are read. A JSON-RPC result counts only in a 2xx answer. The session has 12 s in all, and it is opened only when the scan has that long left before its deadline, so a slow server never cuts the scan short. No redirect is followed: a 3xx answer is reported as "redirects; not followed", and the check is not measured. The scan never calls a tool and sends no other method: no tools/call, no prompts/get, and no resources/read. It passes when tools/list names at least 1 tool, and the record keeps up to 25 tool names and the protocol version. It partially passes when the server answers 401 with a WWW-Authenticate challenge, so an agent can use it with authorization, or when initialize succeeds and the server lists no tool or declares no tools capability. A partial does not hold level 4 or 5: those levels need a server that lists a tool. It fails when the handshake answers an HTML page, a body that holds no JSON-RPC answer, a JSON-RPC error, or another error status, and an HTML page or an answer with no JSON-RPC result is a defect. It is not measured on 403, 429, a 5xx, a 401 with no challenge, no answer, a redirect, the session's 12 s limit, too little time left in the scan, or a refusal by the scanner's guard, and when the endpoint is on a subdomain the removal list names. It is out of scope when no document names an endpoint the scan opens and /mcp answered without signalling MCP. It is also not measured when a card on a subdomain did not answer, or answered 401, 403, 406, 429, or a 5xx. The same holds when its host is on the removal list, or when the scan requested another such card. It is asked only of a site where the scan saw an API or agent surface.

Run the same measurement against your own site. Set the origin on the first line:

ORIGIN=https://example.com
printf 'GET /mcp -> '; curl -sSL -o /dev/null -w '%{http_code} allow=%header{allow}\n' -A 'AgenticWebScore/0.3 (+https://agenticwebscore.com/bot)' -H 'Accept-Language: en' -H 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,text/plain;q=0.8,*/*;q=0.7' "$ORIGIN/mcp"
# The endpoint the record names, or /mcp on the origin.
ENDPOINT="$ORIGIN/mcp"
curl -sS -D - -X POST -A 'AgenticWebScore/0.3 (+https://agenticwebscore.com/bot)' -H 'Accept-Language: en' -H 'Accept: application/json, text/event-stream' -H 'Content-Type: application/json' -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-11-25","capabilities":{},"clientInfo":{"name":"AgenticWebScore","version":"0.3"}}}' "$ENDPOINT"
# The protocolVersion the answer names, and its Mcp-Session-Id header when it sent one.
VERSION=2025-11-25
SESSION=
curl -sS -o /dev/null -w 'notifications/initialized -> %{http_code}\n' -X POST -A 'AgenticWebScore/0.3 (+https://agenticwebscore.com/bot)' -H 'Accept-Language: en' -H 'Accept: application/json, text/event-stream' -H 'Content-Type: application/json' -H "MCP-Protocol-Version: $VERSION" -H "Mcp-Session-Id: $SESSION" -d '{"jsonrpc":"2.0","method":"notifications/initialized"}' "$ENDPOINT"
curl -sS -X POST -A 'AgenticWebScore/0.3 (+https://agenticwebscore.com/bot)' -H 'Accept-Language: en' -H 'Accept: application/json, text/event-stream' -H 'Content-Type: application/json' -H "MCP-Protocol-Version: $VERSION" -H "Mcp-Session-Id: $SESSION" -d '{"jsonrpc":"2.0","id":2,"method":"tools/list","params":{}}' "$ENDPOINT" | grep -o '"name":"[^"]*"' | head -25

Read the mcp-server check page for its sources and the change to make.

MCP server card

An MCP server card describes a remote MCP server. It is an optional extension (SEP-2127), not core MCP.

mcp-card is an unscored check: 0 points. It never fails and never holds a level.

The scanner reads /.well-known/ai-catalog.json first and takes the MCP server card it lists with the media type application/mcp-server-card+json, inline or at a URL on the scanned origin that the scan requested (SEP-2127). It then reads /.well-known/mcp/server-card.json, the Cloudflare convention, and the legacy /.well-known/mcp.json and /mcp.json. It requests the remote URLs of the first card that offers a transport, on the scanned origin only and up to a published cap, with one plain GET and no credentials. A card is usable when it carries a reverse-DNS name containing exactly one slash, a version, a description, and at least one usable remotes entry giving a transport type (streamable-http or sse), a url, and the supported protocol versions. It is present when a usable card has a remote on the scanned origin that answered, or a remote on another origin, which this scan does not request: such a remote is reported as declared, not observed. A remote answers with a 2xx; a streamable-http remote also answers with 405 or 406, the refusal a running server gives a plain GET; and any remote answers with a 401 whose WWW-Authenticate challenge names resource_metadata, as MCP authorization requires. A bare 401 is not counted, because any authorization wall returns one. A remote is not usable when the card itself marks it status declared - a promise is not a transport - or when it is on the scanned origin, the scan requested it, and it answered anything else, except an sse remote's 406, which refuses the scan's Accept header, which is not measured. The card is served with an error when its name is not in reverse-DNS form, when it carries name, version and description but no usable remotes entry, or when a remote it lists is marked declared or answered an error. It is not measured when every remote is on the scanned origin and none was observed - the scan did not request it, it did not answer, it gave a bare 401, or an sse remote answered 406 - when the AI catalog lists a card at a URL this scan did not request and no other card is found, and when no card was found but a card path was not requested, did not answer, or answered 406, which refuses the scan's Accept header. It is not used when every card path answered and none serves a card. A $schema property is accepted when present but is deliberately NOT required: the schema URLs published for this extension do not resolve, and a check that demands a dead URL cannot be satisfied. It is asked only of a site where the scan saw an MCP server. A card the AI catalog lists on a subdomain of the site is read by the mcp-server check, not by this one: with no other card, this check is not measured.

Run the same measurement against your own site. Set the origin on the first line:

ORIGIN=https://example.com
for p in /.well-known/ai-catalog.json /.well-known/mcp/server-card.json /.well-known/mcp.json /mcp.json; do printf '%s -> ' "$p"; curl -sSL -A 'AgenticWebScore/0.3 (+https://agenticwebscore.com/bot)' -H 'Accept-Language: en' -H 'Accept: application/json, application/linkset+json;q=0.9, */*;q=0.5' "$ORIGIN$p" | jq -c '{name,version,description,remotes,entries}' 2>/dev/null || echo "missing or not JSON"; done

Read the mcp-card check page for its sources and the change to make.

Questions about the MCP server tester

Does it call my tools?

No. With an endpoint on the site, the scan opens one session with at most 3 POST requests: initialize, the initialized notification, and tools/list. It reads the tool list and never calls a tool.

Can I test an endpoint URL instead of a domain?

No. The tester takes a domain and finds the endpoint the way an agent does. The check applies when the scan finds an MCP endpoint on the site: in a server card, in the AI catalog, in a homepage link, or at /mcp. An endpoint on another site is not opened.

How do these checks count in the score?

mcp-server is in the web-standards part: 70% of the score, and the one part whose checks hold a level. mcp-card is an unscored check: 0 points. It never fails and never holds a level. The methodology says what each state earns.

Why does it run the full scan?

The form starts the same scan as /scan, so the result is a scan record with a fingerprint you can verify. The report opens on mcp-server and mcp-card, and the full report follows. A stored record younger than 6 hours opens instead of a new scan.