Checkmcp MCP server

<!-- mcp-name: io.github.H129hj/checkmcp -->

CheckMCP

Vendor-neutral quality / security / context-cost audit & score for any MCP server. One uvx/pipx command → an MCP Score /100 + causal opportunities (why the score), Lighthouse-style.

Installed from PyPI as audit-mcp (the name checkmcp was already taken); the command is audit-mcp. Brand, site and repo remain CheckMCP / checkmcp.dev.

uvx audit-mcp https://mcp.deepwiki.com/mcp
# or
pipx run audit-mcp https://mcp.context7.com/mcp --json
audit-mcp https://my-mcp.example.com/mcp --token "$TOKEN"

Use it as an MCP server

audit-mcp mcp turns the auditor itself into an MCP server (stdio) exposing one tool, auditmcpserver — so your agent can answer "is this MCP server safe?" mid-conversation.

# Claude Code
claude mcp add audit-mcp -- uvx audit-mcp mcp

// Cursor (.cursor/mcp.json) / Claude Desktop (claude_desktop_config.json)
{ "mcpServers": { "audit-mcp": { "command": "uvx", "args": ["audit-mcp", "mcp"] } } }

Registry name: io.github.H129hj/checkmcp <!-- mcp-name: io.github.H129hj/checkmcp -->

No dependencies (stdlib only). tiktoken optional for exact token counts.

What it measures (7 pillars)

• Security — OWASP MCP Top 10 (tool poisoning, hardcoded secrets, command injection), lethal-trifecta.
• Tool design — sprawl/consolidation (percentile-calibrated on real servers: median ~7 tools, p95 ~42).
• Schemas / desc — descriptions + inputSchema/outputSchema completeness.
• Context-cost — tokens spent on tools/list, paid on every request (the #1 pain of 2026).
• Compliance — protocol-version gap, annotations, JSON-RPC error conformance, OAuth discovery.
• Reliability — single-shot today (not credited; continuous T3 monitoring on checkmcp.dev).
• Coverage — the 3 primitives (tools + resources + prompts).

Hard floors: secret-in-schema → cap D, failed handshake → cap F. Every penalty is attributed: measure → mechanism → effect → Δscore.

CLI flags

GitHub Action

# .github/workflows/mcp-audit.yml
name: MCP audit
on: [push, pull_request]
jobs:
  checkmcp:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: H129hj/checkmcp@v1
        with:
          url: https://my-mcp.example.com/mcp
          min-score: "70"
          baseline: .checkmcp-baseline.json   # commit it → fails on rug-pull

Shortened. The full README is on GitHub.