Point it at any MCP server.
Find out how good it really is.
A crew of test agents connects to your server, exercises every tool with real models, and hands back what to fix.
No account needed to scan. Public, internal, or pre-release: nothing needs to be store-listed.
contractdeclared contracts
happy-pathprimary jobs
robustnessfailure behavior
securityprotocol-surface posture
openai-storechatgpt app rules
anthropic-storeclaude directory rules
Paste a URL
We run the OAuth 2.1 handshake and register a client. Public, internal, or pre-release: nothing has to be listed anywhere first.
We read the surface
Every tool, resource, and schema your server exposes.
Test agents exercise it
The crew judges everything your server declares and calls the tools too, with real models under real load, against the current spec.
What comes back
api.acme.dev/mcp · crew of 6 · done
primary jobs succeed end-to-end
errors name what failed
listing passes chatgpt app rules
two tools accept args they never declared
destructive tools reachable without a gate
listing passes claude directory rules
23 checks · 6 failed · 5 warned · 12 passed
✕ destructive tools reachable without a gate · 3 tools · no gate declaredSuggested fix
Put the three behind a scope the caller has to hold, or add a confirm argument that must be set before the write lands.