Check your server

Paste the URL of a remote MCP server at protogrid.dev/check, listed or not. protogrid probes it once, runs the quality checks and shows, for the Claude and OpenAI directories, what each requires and what we can see of your server. It takes a few seconds and needs no account. Agents and CI jobs run the same check through POST /v1/check or the check_server tool.

What the probe does

• It asks for the protocol the way a client would: the 2026-07-28 server/discover, then the older initialize and the old HTTP+SSE transport.
• When the server needs no sign-in, it lists the tools with tools/list.
• When it needs sign-in, it reads what any client can read without an account: the WWW-Authenticate header, the protected resource metadata (RFC 9728) and the authorization server metadata (RFC 8414 or OpenID discovery).
• It looks up whether the host has IPv4 and IPv6 addresses, follows at most 3 redirects on the same host and records them, and fetches /.well-known/openai-apps-challenge to see whether a single plain token is published there (the token itself is not kept).

It never sends credentials, never calls a tool, never registers an OAuth client and never connects to private, loopback or internal addresses. URLs that carry credentials (a user name and password, or query parameters such as token or api_key) are refused. Some services put a secret in the URL path instead (/s/<secret>/mcp); that cannot be told apart from a normal path, so do not check such a URL: the result, which anyone with its link can read, would show it. Redirects are followed on the same host only; a redirect to another host ends the check and names that host, so you can check it directly. A whole check is bounded to about 45 seconds and 1 MB per response.

Reading the result

The directory readiness section lists every requirement of each directory, with a link to the page it comes from:

mark	meaning
pass	what we observed meets the item
warn	worth fixing, or a recommendation rather than a rule
fail	what we observed breaks a rule of that directory
?	we could not see it: the tool list behind sign-in, or the server did not answer
you	nobody can see it from outside (privacy policy, test account, example prompts, identity checks); yours to confirm

Items marked “pattern match” are heuristics, such as a tool that takes an HTTP method, descriptions that steer the model toward a tool or hide instructions, or inputs named like passwords or coordinates. They can only ask for a review, never fail.

Requirements change; each result says the date we last read the directories’ documentation. A clean result does not mean a directory will accept your server, and no audit is implied.

The quality section is the same score as on server pages, from one probe. One check has no history, so the stability checks are n/a and there is no trust score; the label is the score band alone.

What the directories ask for, in short

• Claude: https, streamable HTTP, tool names up to 64 characters, a title and readOnlyHint or destructiveHint on every tool; for sign-in, OAuth that answers an unauthenticated request with 401 and resource_metadata, protected resource metadata whose resource is exactly your URL, PKCE with S256, and client registration through CIMD or DCR.
• OpenAI (the ChatGPT and Codex plugins directory): streamable HTTP on a stable public https URL (no tunnels), a domain verification token at /.well-known/openai-apps-challenge, readOnlyHint, destructiveHint and openWorldHint on every tool, and for sign-in OAuth metadata with a matching issuer and S256.

The result page links each item to its source.

Limits and sharing

• Without an account: 5 checks an hour. With an API key: 30 an hour.
• One server host can be checked 12 times an hour in total, whoever asks, so the checker cannot be used to load a third party.
• The same URL checked again within 5 minutes returns the recent result without counting.
• Every result has a link you can share, with a Markdown twin; it is kept for 30 days and never listed or indexed.

Not listed yet?

If your server is not in the catalog, the result shows a starting server.json for the official MCP registry. protogrid mirrors the registry every hour; once your server appears, claim it for hourly probing, alerts and the badge.