MCPTriage

Check an MCP server before you add it to your agent. Name its npm or PyPI package and get a verdict from MoorAI's open-source engine on the downloaded code, ten pre-install checks on the registry metadata, a reputation score and a known-compromised release check. Paste an .mcp.json to see which launches run without an exact version. Static analysis only; the server is never run.

We never store your submission. Scans are of public artifacts — your private work stays on your device.

Check an MCP server package

We fetch that exact artifact, verify the registry checksum, and analyse it. Requests carry public names only: the package name and version to its registry, the repository it declares to GitHub or GitLab, and the server name it declares to the MCP Registry.

…or paste an MCP config

…or choose a file to load into the box — read in your browser, never uploaded until you press Scan.

Remove secrets from env and headers before you paste: they are not needed for the scan.