English Français العربية

MCP Schema Audit

Registre officiel Sécurité

Audits MCP tool definitions for patterns that make models call tools wrong or mis-fill args.

Code source Documentation

Installation

Ajoutez ceci à la configuration MCP de votre client (Claude Desktop : claude_desktop_config.json ; Cursor : .cursor/mcp.json ; VS Code et les autres utilisent la même forme « mcpServers »).

Remote (streamable-http)
Claude Code 
claude mcp add --transport http mcp-schema-audit 'https://mcp-schema-audit-mcp.mcpize.run/mcp'
Configuration JSON (Claude Desktop, Cursor, VS Code) 
{
    "mcpServers": {
        "mcp-schema-audit": {
            "type": "http",
            "url": "https://mcp-schema-audit-mcp.mcpize.run/mcp"
        }
    }
}

Documentation

Tirée du README du projet sur GitHub, actualisée chaque semaine. Les liens ouvrent GitHub.

Sommaire
  1. mcp-schema-audit-mcp
  2. Why this exists
  3. Tools
  4. Use it
  5. Part of a small suite
  6. License

mcp-schema-audit-mcp

An MCP server that audits other MCP tool definitions and marketplace listings for the specific patterns that make models call tools wrong, never call them, or mis-fill their parameters — vague descriptions, missing parameter docs, non-verb-first naming, oversized enums, deeply nested schemas — plus MCPize's own 500-character description limit, which fails at deploy time with no warning until you hit it.

Most tool-definition bugs don't throw errors. They just make a model call the wrong tool, or call the right tool with the wrong arguments, silently and intermittently. This scores every tool 0-100 and tells you exactly which line to fix.

Why this exists

Verb-first naming, parameter descriptions, and schema depth aren't cosmetic — they measurably change how reliably a model picks and fills a tool. This project encodes those patterns as an actual auditor instead of a blog post you have to remember to re-read every time you write a new tool.

Tools

audit_tool_definition

Audit a single tool (name, description, inputSchema). Returns a 0-100 friendliness score and a list of concrete issues, each with severity, why it matters, and the fix.

audit_tool_batch

Same checks across an entire server's tool list, plus cross-tool checks: duplicate names, inconsistent naming convention (snake_case vs camelCase mixed in one server), and a worst-offenders summary.

check_marketplace_description

Validates a marketplace-facing short/long description against known platform limits — specifically catches MCPize's 500-character short-description cap before you burn a deploy attempt finding out the hard way.

Use it

Hosted (recommended, no setup): subscribe on MCPize — free tier included, $7/mo for higher limits.

Self-host:

npm install
node server.js

Exposes a Streamable HTTP MCP endpoint on :8080 (/mcp), health check at /health.

Part of a small suite

Built alongside three sibling correctness-audit tools for Claude Code / MCP builders: cron-schedule-audit-mcp (DST-correct cron validation), regex-safety-audit-mcp (ReDoS detection), and claude-cost-audit-mcp (exact Claude API cost + cache-economics calculator).

License

MIT

Questions fréquentes

Qu'est-ce que MCP Schema Audit ?

Audits MCP tool definitions for patterns that make models call tools wrong or mis-fill args.

Comment installer MCP Schema Audit ?

Il fonctionne comme serveur distant. Dans Claude Code : claude mcp add --transport http mcp-schema-audit 'https://mcp-schema-audit-mcp.mcpize.run/mcp'. Pour les autres clients, collez la configuration JSON de cette page dans leurs réglages MCP.

Faut-il une clé API pour MCP Schema Audit ?

Son entrée au registre n'indique aucune clé ni secret obligatoire. Certaines fonctions peuvent tout de même demander un compte auprès du service auquel il se connecte.

MCP Schema Audit est-il open source ?

Oui. Son code est sur GitHub sous licence MIT.

Qui maintient MCP Schema Audit ?

Il est publié par tylerscomic-lab. AI.tn le référence sans le maintenir ni le recommander.

Issu du registre MCP officiel. Être listé n'est pas une recommandation : vérifiez le code et les permissions d'un serveur avant de lui donner accès à vos données.