Get your free
MCP-Server Audit
Check your MCP server for token efficiency, tool design, and MCP best practices for free.
Trusted by enterprises and SMEs
Get a full Audit of your MCP server
We review your server the way an AI agent experiences it — from the first handshake to the last token of a tool response.
Basic setup
Are you using the right transport protocol (MCP-Streamable HTTP instead of legacy SSE), a reachable and stable endpoint, correct protocol version negotiation and only the capabilities you actually implement?
Are the tools well designed?
Correct titles, meaningful descriptions and clear responsibilities per tool — no overlapping tools, no catch-all tool that does five unrelated things, no tool the model can never pick correctly.
Tool inputs with good documentation
Input schemas the model can actually fill in: descriptive parameter names, documented fields, sensible required flags, examples and enums that are short enough to be useful.
Token bloat
Does your MCP server ship unnecessarily long and complex documentation, oversized schemas and huge responses that burn context on every single call?
Security best practices
What kind of security is actually implemented? Is every request authenticated and authorised, is sensitive data protected end to end, and do tool calls and responses avoid leaking secrets, internal IDs, tokens or more public information than a caller should ever see?
OAuth discovery support
Does your server support OAuth 2.1 with proper discovery (protected resource metadata, authorization server metadata, dynamic client registration) so your users can connect from any MCP client in one click instead of pasting API keys?
The full audit checklist
Twelve categories of MCP best practices, checked against your server and reported with concrete, actionable findings.
Token Efficiency
- Oversized descriptions
- Unnecessary schema tokens
- Large tool responses
- Repeated fields
Tool Design
- Too many tools
- Overlapping tools
- Unclear responsibilities
- Poorly scoped parameters
Tool Descriptions
- Verbose descriptions
- Ambiguous descriptions
- Missing usage context
Input Schemas
- Unnecessary parameters
- Overly complex schemas
- Unclear parameter names
- Huge enums
Response Design
- Excessive JSON
- Unnecessary metadata
- Deeply nested responses
- Duplicated information
Filtering & Pagination
- Can callers request fewer fields?
- Limit results?
- Paginate?
- Filter server-side?
Context Efficiency
- Does the server send information the model does not need?
- Could content be summarized first?
Naming
- Clear tool names
- Consistent naming
- Names that help the model choose correctly
Errors
- Useful error messages
- Excessive error payloads
- Errors that tell the model how to recover
Discoverability
- Can an LLM easily understand when each tool should and should not be used?
Security / Configuration
- Which security mechanism is implemented (API key, OAuth 2.1, mTLS, none)?
- Is sensitive data encrypted in transit and never logged?
- Exposed secrets, tokens or credentials in schemas, descriptions or responses
- Do tool calls and results expose more public information than necessary?
- Unsafe defaults, missing authorization checks per tool
OAuth & Discovery
- Does the server support OAuth 2.1 authorization?
- Protected resource + authorization server metadata discovery endpoints
- Dynamic client registration for one-click client onboarding
- Correct scopes, token audience validation and expiry handling
Protocol Best Practices
- Correct MCP primitives and capabilities
- Protocol behavior
- Compatibility issues
Get your dedicated MCP-Server security check by our team of experts
Beyond the automated audit: our engineers review your authentication, configuration and data exposure hands-on and walk you through the findings.
MCP-Server Audit FAQ
Everything about auditing your MCP server for efficiency and best practices
Be first to audit your MCP server
The MCP-Server Audit is coming soon. Add your email and we will notify you at launch.