Check an MCP server before release.

Three ways to use MCP Release

• BrowserPublic HTTPS endpoint validation. No install required. No credentials accepted or stored.
• CLILocal, private, authenticated, localhost, and stdio servers. Credentials stay on your machine.
• GitHub ActionsAutomated MCP validation in CI. Secrets stay in GitHub secrets and are never sent to MCP Release.

Release scenariosNew in v0.3.0

Define multiple named scenarios in a YAML config file and validate them in one run — authenticated success, expected auth failures, rate limits, retries, and timeout resilience.

• Authenticated success via Bearer token or custom headers
• Missing, invalid, expired, and forbidden credentials
• Expected negative responses with defined expect blocks
• Rate limits and Retry-After header handling
• Explicit retries with configurable backoff
• Connect, response, and total scenario timeouts

CLI:

mcp-release check --config mcp-release.config.yml

Example config (mcp-release.config.yml):

version: 1
endpoint: https://your-mcp-server.example.com/mcp

scenarios:
  - name: authenticated
    headers:
      Authorization: "Bearer ${MCP_TOKEN}"
    expect:
      result: pass

  - name: anonymous
    expect:
      result: warning
      httpStatus: 401

Retry configuration:

retries:
  maxAttempts: 3
  backoffMs: 1000
  retryOn:
    - rate-limit
    - server-error
    - connection-failure
    - response-timeout

Local stdio validation

Available since v0.2.0. MCP Release can spawn and validate any MCP server that communicates over stdin/stdout. Pass a command string; MCP Release starts the process, performs MCP initialization, discovers tools, validates schemas, and shuts down cleanly.

Validation runs entirely on your machine or GitHub Actions runner. No stdio validation data is sent to MCP Release servers. The spawned process, its output, and all findings stay local.

What it checks:

• MCP initialization handshake and protocol negotiation
• Tool discovery and schema validation
• Unexpected output on stdout (logs must go to stderr)
• Malformed MCP messages on stdout
• Response size limit
• Startup timeout
• Clean shutdown after stdin EOF

CLI:

npx -y @mcp-release/cli check --stdio --command "npx -y my-mcp-server"

# With a working directory
npx -y @mcp-release/cli check --stdio --command "node dist/server.js" --cwd ./my-server

GitHub Actions:

- uses: daranium2020/mcp-release@v0.3.0
  with:
    transport: stdio
    command: npx -y my-mcp-server

What MCP Release checks

• ProtocolMCP initialization handshake, protocol version negotiation, and transport behavior
• Tool schemasTool names, descriptions, input schemas, output schemas, and duplicate detection
• Network safetySSRF protection, DNS pinning, redirect validation, and private address blocking (HTTP/SSE)
• Stdio transportUnexpected stdout output, malformed MCP messages, response size limits, and clean shutdown
• ReportsFindings exportable as JSON or Markdown

Understanding results

• PASS
  All checks passedThe endpoint responded correctly and all validated properties met requirements. A PASS reflects the checks MCP Release ran. It is not a guarantee of correctness.
• WARNING
  Some checks did not completeOne or more checks could not complete or found a non-blocking issue. If your server requires authorization, MCP Release returns AUTH_REQUIRED as a warning. In the browser checker, authenticated checks are not performed. The browser checker does not accept or store credentials. Use the CLI or GitHub Action for authenticated scenarios.
• FAIL
  One or more blocking findingsAt least one check found a blocking condition. Examples: an invalid tool name, a missing required schema field, or a transport error.

Security model

• Tools are discovered via tools/list but never invoked. No arguments are constructed or sent.
• Only public HTTPS endpoints are accepted by the web checker. HTTP is rejected before any connection.
• Private, loopback, link-local, and cloud-metadata destinations are blocked at the DNS level
• Redirects and resolved IP addresses are re-validated at each hop
• Remote response bodies and credentials are never included in findings
• The web checker does not accept, forward, or store endpoint credentials

Use from the terminal

For private, staging, localhost, or authenticated endpoints, use the CLI. Credentials stay on your machine.

npm install -g @mcp-release/cli

# HTTP/SSE endpoint
mcp-release check https://your-mcp-server.example.com/mcp

# Or without installing
npx -y @mcp-release/cli check https://your-mcp-server.example.com/mcp

Local stdio server:

npx -y @mcp-release/cli check --stdio --command "npx -y my-mcp-server"

Try the demo endpoint

A public fixture server is available for testing. It returns fixed results with no external dependencies.

Use the Try demo endpoint button in the form above, or paste this URL and click Run Release Check.