Validate MCP configuration JSON and statically inspect server commands, arguments, environment variables, remote endpoints and embedded credentials before you run an MCP server.
This first MCP Toolkit scanner performs static analysis of common Model Context Protocol client and server configuration patterns.
Local MCP integrations commonly launch servers using stdio. Remote deployments generally use Streamable HTTP. Older HTTP+SSE configurations may still exist for compatibility.
This validator identifies transport indicators but does not contact remote endpoints during static analysis.
An MCP configuration can grant an AI application access to local commands, files, APIs, credentials and remote services. A configuration that looks small can therefore carry meaningful security impact.
Review the server package, its tool permissions and the commands it can execute before trusting it with sensitive systems.
This tool analyzes only the JSON you submit. It does not prove package integrity, inspect the source code of an MCP server, verify OAuth behavior or test a remote server for runtime vulnerabilities.
Those checks will be provided by separate MCP Toolkit security tools.
Validate MCP server JSON configurations and statically scan commands, environment variables, remote URLs, secrets and risky execution settings.
Use MCP Config Validator as a focused pre-flight utility while building, reviewing or debugging an MCP integration. Paste the relevant configuration, protocol message, metadata, schema or value into the tool and review the returned findings before the same data reaches a production client or server.
This validator is useful before configuration is committed, shared with another client or moved into production. Structural validation catches many integration problems early, but runtime behavior should still be tested with the exact client and server implementation you use.
A clean result means the input passed the rules implemented by this utility. It does not guarantee application security, protocol interoperability or correct business behavior. Test important integrations against the exact MCP client, SDK, gateway and server versions used in your deployment.