MCP Check / About
How we check an MCP server
We read the instructions MCP servers hand your AI, quote the sentences that matter, and date every change. The one grade here is for a server's tool text, never for the server: a flag says what its tool list says.
What we read
Remote servers from the official MCP registry, and any https:// address you paste, over Streamable HTTP. We send three messages: initialize, notifications/initialized and tools/list. We keep the tool names, descriptions, parameters and annotations, and store a dated snapshot whenever they change. A read takes 1–3 seconds and stops after 8.
What we never do
- We never call a tool.
- We never send credentials, cookies or an
Authorizationheader. A server that wants a login shows up as "needs a login", nothing more. - We never run a server on our machines, so local servers go unread.
- We never say a server is good or bad. A flag says what the text says, not what the server does.
A and D: how a flag was found
Every finding carries one of two marks. D is a plain check, a rule over the text: an annotation that says destructiveHint: true, a hidden character, an encoded block. A was read by Jev, our AI reader, which reads each description, answers fixed questions about it, and quotes the sentence it relied on.
Jev, our AI reader, can be wrong
Jev sees each tool's own text and nothing else: its name, title, description and parameter descriptions; no dates, nothing about the publisher. It can misread a sentence, miss one, or quote the wrong one. A tool it could not read says "not read" instead of passing, and we read a server again whenever its tools change. If a quote is wrong, tell us below.
The tool text grade
Each server we read through completely gets a letter for its tool text, from A to F. The worst row that applies wins.
| Grade | When |
|---|---|
| A | Nothing to flag. A tool that says in its own text that it writes or deletes still counts as honest. |
| B | Its tools changed in the last 30 days, a tool writes while its own annotation says read-only, or a text field is very long and nothing else is hidden in it. |
| C | A tool tells your AI to do something beyond using the tool (Extra orders). |
| D | A tool tells your AI to keep something from you, or asks for keys it does not need (Don't tell, Wants your keys). |
| F | Hidden characters, encoded blobs or tag-like markers (Invisible ink), or two or more of Extra orders, Don't tell and Wants your keys. |
No grade when any tool went unread, the read stopped short, or the server lists no tools. The worst row that applies wins.
A grade covers what the tool text says, not what the server does. Spot a wrong grade? Report it from the server page.
Opt out, or correct a page
Write to [email protected] from an address at the publisher's domain or GitHub organisation, naming the server. To correct a reading, quote the sentence and say what we got wrong; we read the server again and reply. To opt out, say so: we hide the page from every list and from search engines, and stop reading the server.
The six flags
Extra orders
Tells your AI to do something beyond using this tool.
Not a claim that the tool does it, or that anyone meant harm.
Don’t tell
Tells your AI to keep something from you.
Not a claim that anything was actually kept from you.
Wants your keys
Asks for keys, tokens or files the tool's job does not need.
Not a claim that anything was taken, only that it was asked for.
Can break things
Writes, deletes, sends or runs commands.
Not a claim that it will break anything; only that it can change things.
Invisible ink
Has hidden characters, encoded blobs, tag-like markers or a very long text field.
Not a claim that the hidden part is doing anything.
Changed its story
Its tools changed since our previous snapshot.
Not a claim that the change was wrong; updates are normal.
API and MCP
Every page has a JSON twin: GET https://slop.watch/mcp/api/check?server=<name or URL> returns the same check as the page, and GET https://slop.watch/mcp/api/diff?server=…&since=… the changes between snapshots. Our own MCP server at https://slop.watch/mcp offers check_mcp, diff_mcp and explain_flags, all read-only. No account, no key; please keep to a request a second.
We are an MCP server too. Our tool list is as plain as anyone's.