# MCP Server Explorer

> Inspect any MCP server before you connect an AI agent: tools, permissions, risks, changes over time. Connects to a remote Model Context Protocol server (current stateless 2026-07-28 protocol or the classic initialize handshake, JSON or SSE responses), lists its tools, resources and prompts, and classifies every tool: capabilities (read, write, delete, execute, network, files, payments, messaging, secrets), annotation consistency, schema quality and tool-poisoning markers. It remembers a fingerprint per server so later checks show added, removed and silently changed tools. You can also paste a tools/list result or search the official MCP Registry.

Part of usefulweb.site (https://usefulweb.site/). Results are deterministic calculations from the inputs and the listed assumptions; the API returns exactly what the web page shows.

## Use it
- Human interface: https://mcpserverexplorer.usefulweb.site/ (interactive tool at https://mcpserverexplorer.usefulweb.site/tool)
- JSON API: POST https://mcpserverexplorer.usefulweb.site/api/v1/calculate with a JSON object of inputs (schema: https://mcpserverexplorer.usefulweb.site/api/v1/tool)
- OpenAPI: https://mcpserverexplorer.usefulweb.site/openapi.json
- MCP (Streamable HTTP): https://mcpserverexplorer.usefulweb.site/mcp - tool `mcp_server_explorer`

## Inputs
- mode (select): What do you want to do?
- url (url): MCP server URL
- toolsJson (textarea): tools/list JSON
- search (text): Registry search
- remember (boolean): Remember this server's tool fingerprints to detect changes - Stores a hash of the URL and per-tool hashes only.

## Method
- Connect: POST server/discover (MCP 2026-07-28, stateless, with MCP-Protocol-Version and Mcp-Method headers); if unsupported, the classic initialize → notifications/initialized handshake (2025-11-25) with Mcp-Session-Id. JSON and SSE responses are both parsed. tools/list, resources/list and prompts/list are paginated up to 5 pages.
- Capabilities are inferred from the tool name (write/delete/execute) and name + description (network, files, payments, messaging, secrets). Risk: high = delete/execute/payment, destructiveHint=true or poisoning markers; medium = write/messaging/secrets/open-world network; otherwise low.
- Issues: annotations contradicting the name, missing annotations, missing descriptions, undocumented input properties, and text patterns typical of tool-poisoning (hidden instructions, references to ~/.ssh or .env, "do not tell the user").
- Changes: with "remember", per-tool SHA-256 fingerprints of description + input schema + annotations are stored under a hash of the URL; the next check lists added, removed and changed tools (a changed description is how "rug-pull" attacks work).
- Registry: GET registry.modelcontextprotocol.io/v0/servers?search=…