McpStamp Check

McpStamp Check

Score any remote MCP server for readiness for the Claude Directory, ChatGPT Apps, Gemini Connected Apps and the MCP Registry: a 0-100 score, an A-F grade, per-store readiness and a one-line fix for every failing check.

Try it: https://www.mcpstamp.com/check/

Badge

After a check, embed your badge in your README (<id> is in the check result):

[![McpStamp](https://www.mcpstamp.com/badge/<id>.svg)](https://www.mcpstamp.com/check/?id=<id>)

The badge shows McpStamp | 87 B, coloured by grade, or a grey unchecked.

MCP server

McpStamp Check is itself a remote MCP server (Streamable HTTP, protocol 2025-11-25, no sign-in):

https://mcp.zovo.one/stamp/mcp

Add it to your client:

# Claude Code
claude mcp add --transport http mcpstamp https://mcp.zovo.one/stamp/mcp

// Cursor: ~/.cursor/mcp.json
{ "mcpServers": { "mcpstamp": { "url": "https://mcp.zovo.one/stamp/mcp" } } }

// VS Code: .vscode/mcp.json
{ "servers": { "mcpstamp": { "type": "http", "url": "https://mcp.zovo.one/stamp/mcp" } } }

Then ask: "Check https://example.com/mcp with McpStamp". Live checks share the API limit (20 per hour per client). It is listed in the MCP Registry as io.github.theluckystrike/mcpstamp-check.

GitHub Action

Gate your CI on readiness. The action calls the public API, writes a job summary (score, stores, fixes) and fails the step when the score is below min-score or a store in fail-on-store is not ready.

name: McpStamp Check
on:
  workflow_dispatch:
  push:
    branches: [main]
jobs:
  mcpstamp:
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - uses: theluckystrike/mcpstamp-check@v1
        id: stamp
        with:
          url: https://example.com/mcp
          min-score: 80
          fail-on-store: claude,chatgpt
      - run: echo "Score ${{ steps.stamp.outputs.score }} (${{ steps.stamp.outputs.grade }}): ${{ steps.stamp.outputs.report-url }}"

Outputs: score, grade, report-url, badge-url, ready-stores.

The action is a composite action that runs action/run.mjs with the runner's Node.js (18 or later), with no dependencies and no build step. Check a deployed URL: run it after your deploy step.

API

Base URL: https://mcp.zovo.one/stamp (also proxied at https://www.mcpstamp.com/api/).

Errors: 400 {error:"bad_url"|"blocked_host"}, 429 {error:"rate_limited", retry_after}, 502 {error:"unreachable"|"blocked_by_firewall", detail} (blocked_by_firewall: the server's WAF or bot protection answered with a 403 HTML page or a Cloudflare challenge, so nothing was scored). Limits: 20 live checks per hour per IP; at most 10 HTTP requests to the checked server per check and 25 s wall time per check; 8 s timeout and 1 MB body cap per request; https only, ports 443/8443, no IP literals or private names; every URL fetched (first URL, each of max 3 redirect hops, each discovery URL) is re-validated and its DNS answers (DNS-over-HTTPS) must be public. Results are kept 30 days; a badge request for a result older than 7 days triggers one background re-check. Credentials in the URL (the segment after /t/, random-looking path segments of 24+ characters, secret query values) are shown and stored as REDACTED.

Proxies

A trusted proxy (the mcpstamp.com Pages Functions) may send x-mcpstamp-proxy-key: <PROXY_KEY secret> and x-mcpstamp-client-ip: <visitor IP> so the rate limit applies per visitor, not per proxy.

Scoring

Each check is pass (1), warn (0.5), fail (0) or skip (not counted). Score = weighted pass ratio over the checks that apply. Grades: A >= 90, B >= 80, C >= 65, D >= 50, else F. Each store gets status: ready (no blocking check failed and none was skipped), unverified (none failed, but a blocking check could not run, for example tools behind sign-in) or not_ready (a blocking check failed). ready is true only for ready. When the tools sit behind sign-in and cannot be inspected, the score is capped at 85. Skipped checks carry skip_reason: not_applicable, needs_sign_in, not_probed (request or time budget), not_reached (handshake did not complete) or blocked; each store lists unverified_reasons. A check may carry store_status when one store treats it more softly (for example legacy SSE is a warning for Claude and the Registry). The registry store means "a valid remote for the MCP Registry" (public https, answers as Streamable HTTP or SSE), not that the server is published there.

Every rule is traced to the store or spec text in SOURCES.md.

Use the engine

src/check.mjs is a pure ES module with no dependencies. It runs in Node 20+ and in Cloudflare Workers:

import { checkServer, CHECKS } from './src/check.mjs';
const result = await checkServer('https://example.com/mcp', { fetch, timeoutMs: 8000 });
console.log(result.score, result.grade, result.stores.claude);

Every fetched URL passes a host guard (syntax plus DNS). By default DNS goes through DNS-over-HTTPS (1.1.1.1) and the check refuses when DNS cannot be read. In Node, pass the system resolver so LAN and /etc/hosts names are judged by the same answers fetch will use:

import { nodeResolve } from './src/resolve-node.mjs';
await checkServer(url, { fetch, resolve: nodeResolve });

CLI: node scripts/check-cli.mjs https://example.com/mcp [--json]

Develop

npm test             # node --test, mock fetch, no network (engine, Worker, MCP endpoint, action)
npx wrangler deploy  # Worker "mcpstamp-check"

Contact: support@zovo.one

License

MIT