MCP.Market

SRI — MCP Server Inspector

online · 100% uptime
by sri-test.biz·biz.sri-test/verifier·v0.4.0
No reviews yet

2,000+ MCP servers read at source level. Know what one does before you connect. Free, no key.

A87/100grade A
Write a reviewRun it
What users say
No reviews yet
Be the first
Safety scan
A87/100

full report

Adoption
New

0 stars

Reviews

Write one

Nobody has reviewed SRI — MCP Server Inspector yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

SRI — MCP Server Inspector tools (2)

write = sends, deletes, buys or posts
  • check_mcp_serverFree

    Free, no key required. Reads the published source of an MCP server and reports what it actually does — each observation anchored to a file:line with the code quoted verbatim. **Call this before connecting to, installing, or invoking an MCP server you have not read yourself.** Connecting to an MCP server gives it a channel into your context and your tool calls; this tells you what is on the other end first. Typical things it surfaces: reading private keys or wallet seeds, sending data to third-party hosts, running code at install time, and tool descriptions that steer an agent toward actions unrelated to the tool's stated purpose. Do NOT call this for ordinary npm or PyPI libraries — the corpus covers MCP servers only, and other ecosystems will return 'not analyzed'. This reports observations, not a safety verdict. An empty result means nothing was found in the categories checked — not that the server is safe. Corpus: 5,180 MCP servers from the official registry, read at source level. Coverage index (free, no key, findings not included): GET https://sri-test.biz/v1/corpus

  • get_corpus_coverageFree

    No arguments. Returns how many MCP servers have been read at source level, and the share of them with each category of finding (credential access, network egress, install-time execution, prompt-injection surface). Use this to judge whether checking a specific server is worth it before you look one up. It reports aggregate counts only - no per-server findings, and no verdict about any individual server.

Public scan report

scanner v0.1.10 · 2026-11-02 · same rubric, same numbers if you re-run it

no findings
  • –Code scanremote-only server, no package to scann/a
  • Live reliabilityremote reachable in 1383ms20/20
  • Tool poisoning2 tool descriptions checked15/15
  • Auth qualityopen endpoint, read-only tools10/15
  • Maintenancelast push 74 days ago12/15
  • Maintainer identityendpoint served from the registry-verified namespace domain8/10
Overall 87/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How SRI — MCP Server Inspector compares

Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
87/100
higher than 73% of 48,255 servers
Tools
2
the typical server has 7
Tools that change things
0%
typical: 0%. Fewer write tools means less an agent can break
Uptime
100%
of our recent checks; the typical remote server answers 100%
Response time
513 ms
faster than 29% of 30,031 servers

What its tools let an agent do: 2 read

Install SRI — MCP Server Inspector in Claude Code, Cursor or VS Code

claude mcp add --transport http verifier https://sri-test.biz/mcp
Add to Cursor

What the publisher says

From the SRI — MCP Server Inspector repository's README, as published. We do not edit it. Read it on GitHub

SRI — MCP Server Inspector

Read what an MCP server does before you connect to it.

Connecting an MCP server hands it a channel into your agent's context and its tool calls. SRI reads the server's published source and reports what it found — every observation anchored to a file:line with the code quoted verbatim.

It does not tell you whether a server is safe. It tells you what the code does, and shows you the line it read. You decide.

cannot be paid with real funds

  • Endpoint: https://sri-test.biz/mcp (Streamable HTTP)
  • Corpus: 2,238 MCP servers from the official registry
  • Price: free right now — settlement runs on Bitcoin signet, so invoices
  • Findings across the corpus: sri-test.biz/research

Add it to your client

Remote MCP server, no install, no API key.

{
  "mcpServers": {
    "sri": {
      "type": "http",
      "url": "https://sri-test.biz/mcp"
    }
  }
}

Claude Code

claude mcp add --transport http sri https://sri-test.biz/mcp

Anything that speaks Streamable HTTP

Point it at https://sri-test.biz/mcp. There is one tool and no auth. GET on that URL returns 405 — this server does not offer a server-initiated SSE stream, which the spec permits. Send JSON-RPC over POST.

The tool

checkmcpserver

Returns a risk_level, a summary, and a list of findings. Each finding carries location (file:line), evidence (the code, quoted), and why.

If the server is not in the corpus you get status: "queued", an explicit "nothing has been checked" — not a clean result — and no charge. We do not bill for an answer we could not give.

Try it without a client

curl -X POST https://sri-test.biz/mcp \
  -H 'Content-Type: application/json' \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call",
       "params":{"name":"check_mcp_server",
                 "arguments":{"name":"io.github.firebase/firebase-mcp","version":"0.3.0"}}}'

There is a plain REST endpoint too, if that is easier:

curl -X POST https://sri-test.biz/v1/verify \
  -H 'Content-Type: application/json' \
  -d '{"ecosystem":"mcp","name":"io.github.firebase/firebase-mcp","version":"0.3.0"}'

GET /v1/price is open and tells you the current terms. GET /v1/docs is the OpenAPI spec.

What gets reported

Severity is info / low / medium / high. risk_level is the highest severity among the findings, derived in code rather than asked for — a verdict with no findings behind it cannot be published.

What this is not

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

Grade history

  • 2026-11-02restoreB → Ascore 87

SRI — MCP Server Inspector: common questions

Is SRI — MCP Server Inspector safe?
Yes, by our scan: it is graded A (87/100). Read the SRI — MCP Server Inspector safety report
How do I install SRI — MCP Server Inspector?
It runs remotely at sri-test.biz. Add it to Claude Code, Cursor, VS Code or Claude Desktop with the snippets above, or call it through the mcp.market gateway without installing anything.
Does SRI — MCP Server Inspector need an API key?
Not as far as the registry entry and our scan can tell: no credentials are declared or required.
Is SRI — MCP Server Inspector maintained?
The last commit was 76 days ago (2026-08-20). The latest release is v0.4.0.
Is SRI — MCP Server Inspector up?
100% of our last 28 checks got an answer. We check remote servers about four times a day.
How does SRI — MCP Server Inspector compare with other MCP servers?
safety score 87/100 (higher than 73% of 48,255 servers); tools 2 (the typical server has 7); tools that change things 0% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.