MCP sign-in check

Check your server

What the check does

1. It sends an initialize request with no token. A server that asks for a sign-in answers 401.
2. It reads the protected resource metadata (RFC 9728).
3. It reads the authorization server metadata (RFC 8414).
4. It makes sure that code_challenge_methods_supported includes S256 (PKCE).
5. It registers a client with the name "Rondar MCP check" at the registration endpoint (RFC 7591). The redirect address of that client has no page.
6. It stops there. It does not open the sign-in page, it does not ask for a token and it does not call a tool.

These are the steps that Rondar does before each real sign-in at a remote MCP server. The check uses the same code.

Use it in CI

Send a POST request with the address in JSON. You do not need an account or a token.

curl -fsS -X POST https://rondar.dev/mcp-check/api \
  -H 'content-type: application/json' \
  -d '{"url": "https://mcp.example.com/mcp"}' \
  | jq -e '.passed'

The answer is 200 for each finished check. It has status (passed, failed or open), passed, steps, report_url and, for a passing check, badge_url. Each failed step has failure, fix and docs_url.

A refused request gets 422 or 429 with error and message. A check of the same address in the last 10 minutes gives the last report again, with "reused": true.

Limits

Rondar checks only public HTTPS addresses. It does not call private, local or metadata addresses, and it does not follow a redirect.

The check does not sign in. It does not test what happens after the sign-in page, and it does not check a server that needs a key before the sign-in.

All steps together stop after 15 seconds. One network address can start 20 checks in an hour. One host can get 3 new checks in 10 minutes.

Each check leaves one registered client with the name "Rondar MCP check" on your authorization server. You can remove it.

Each check makes a dated report. The report is unlisted: a person with its address can open it, but Rondar does not list it and asks search engines not to index it. A passing report gives a badge for your README.