Does it execute any tools on the server?

No. It calls initialize and tools/list only, and reads the descriptions and schemas. Nothing is invoked.

What about servers that need a token, or run locally over stdio?

Pass headers.Authorization for a remote server (used for that call, never stored), or pass the tools[] array from your own tools/list call. Servers that answer 401/403 return an error and are not charged.

Can a clean grade be trusted completely?

It means the server's tool definitions contain nothing we recognise as an attack today. A server can still change its tools later (rug pull), so audit again when a tool list changes.

Grade an MCP server before you let an agent connect to it.

An MCP server's tool descriptions go straight into the model's context, so a malicious server can tell the agent to read your SSH keys 'before using this tool' or to hide its actions from you. The audit connects to the server like a client, lists every tool and grades what an agent would be exposed to, with the exact text that triggered each finding. Pass a tools list instead for stdio servers.

What you get back

grade A–F, score 0–100 and a one-line verdict (do not connect / connect with care / looks safe)
server: name, version, protocol version, transport, https, whether it answered without auth
findings[]: tool poisoning (hidden instructions, read-this-file-first, do-not-tell-the-user, shadow other tools, consent claims), hidden Unicode, raw command / sql / path / url inputs, destructive tools without readOnlyHint or destructiveHint, misleading readOnly annotations, duplicate and generic names, plain http, oversized tool lists
tools[]: each tool with its risk level and finding count

Call it over HTTP

No account and no API key. The first response is 402 Payment Required with the price; an x402-capable client pays in USDC on Base and retries. You're only charged when the call succeeds.

curl -i -X POST https://api.exepal.com/v1/scan/mcp \
  -H "content-type: application/json" \
  -d '{"url":"https://api.exepal.com/mcp"}'
# → 402 Payment Required (price, network: base, pay-to address)
# An x402 client pays in USDC and retries → 200 with the JSON answer

Use it from Claude, Cursor or any MCP client

Add https://api.exepal.com/mcp as a remote MCP server. The tool is scan_mcp, at the same price.

{
  "mcpServers": {
    "exepal": { "type": "http", "url": "https://api.exepal.com/mcp" }
  }
}

Questions

Does it execute any tools on the server?: No. It calls initialize and tools/list only, and reads the descriptions and schemas. Nothing is invoked.
What about servers that need a token, or run locally over stdio?: Pass headers.Authorization for a remote server (used for that call, never stored), or pass the tools[] array from your own tools/list call. Servers that answer 401/403 return an error and are not charged.
Can a clean grade be trusted completely?: It means the server's tool definitions contain nothing we recognise as an attack today. A server can still change its tools later (rug pull), so audit again when a tool list changes.