- Who it helps
- Developers reviewing MCP servers they own or are authorized to test.
- Availability
- Public MIT-licensed CLI and GitHub Action requiring Node.js 20 or later. Running checks against a server can incur that server’s normal costs.
What its report tells you
The project produces JSON, HTML and JUnit reports. Its published example uses an intentionally faulty server to show findings such as a leaked secret pattern, a hidden instruction and an unmarked destructive tool. That fixture demonstrates the format; it does not measure detection accuracy on other servers.
QAmcp CLI: inspect an MCP server ↗QAmcp example report and checks ↗
Read-only labels are a dependency
Safe mode relies on the server’s tool annotations. A wrongly labelled tool can still change data. The documented look-only mode avoids calling tools. A passing score covers the checks actually run, so skipped tests and coverage belong beside the score when deciding whether a server is suitable.
QAmcp CLI: inspect an MCP server ↗QAmcp example report and checks ↗
What you can do
- Inspect the sample report and safe-mode assumptions before choosing which checks to run on a test server. Open reference ↗
Where the evidence stops
No CLI or server was executed here. Deterministic checks cannot prove that a tool is harmless, that every hidden instruction is detected or that its business behavior is correct.
Sources read. Sources checked October 22, 2026 UTC. No external software workflow, model inference or reported experiment was executed.
Sources & further reading
GitHub · implementation
QAmcp CLI: inspect an MCP server ↗
README describes deterministic checks, reports, Node requirements and safe-mode limits. No server was tested here.
QAmcp · page checked 2026-10-22
Web · official
QAmcp example report and checks ↗
Inspected the author’s intentionally faulty server report. Its failures demonstrate the report format, not independent test accuracy.
QAmcp · page checked 2026-10-22
More sources reviewed (1)
Hacker News · discussion
Show HN newest launch sample ↗
Read the first eighteen titles and their source links. Seven directly relevant launches were identified; hours of activity do not cover a week.
Hacker News · page checked 2026-10-22
Coverage note: The linked primary evidence was inspected. Independent execution and a complete cross-platform discussion sample are missing; no original X source was verified.
The record over time (1)
Dated source checks and published explanations. An observation date can differ from the original release date.
- · Added to Current
QAmcp checks the interface and behavior of an MCP server, which supplies tools to an AI agent. Its reports can expose missing descriptions, schema failures, timeouts and suspicious instructions.