Starts a server we broke on purpose, on your computer only, tests it, and writes qamcp-demo-report.html. About 30 seconds.
Prefer to install it once? npm install -g qamcp-cli, then just type qamcp. See every option any time with npx qamcp-cli --help.
| --header "Name: value" | Send a header, for a server that needs an API key. Example: --header "Authorization: Bearer YOUR_KEY". Can be repeated. |
| --login | For a server that needs you to sign in: opens its login page in your browser. The login is used for this test only. |
| --stdio "<command>" | Start this program and test it: a server that runs on your computer. |
| --env NAME=value | An environment variable for the --stdio program, like an API key. Can be repeated. |
| --cwd <folder> | The folder to start the --stdio program in. |
| --timeout <seconds> | Time limit for each request. Default 20. |
| --no-history | Don't remember this server's tools between runs. Without it, the next run shows exactly what changed in the tools. |
By default it only runs tools the server labels read-only, and never runs tools that sound destructive, like delete_account, in any mode.
| --before-install | About to add someone else's server to Claude or Cursor? A quick safety look in plain words: red flags, and which tools can change, send or delete things. Calls no tools. |
| --look-only | Call no tools at all; only read what the server says about itself. For a server you don't trust. |
| --owner | Your own server: also run unlabeled tools whose names clearly only read (get_, list_, search_…). |
| --run-unlabeled | Your own test copy: run every tool not named or labeled dangerous. Never on live data. |
From then on every git commit tests your server first, and stops the commit if it scores below 80 (change it with --fail-under). Skip it once with git commit --no-verify.
On GitHub, the action QAmcp/qamcp-cli@v0 does this and comments the score on each pull request. See Run it in CI.
| --fail-under <score> | Fail if the score is below this. |
| --fail-on-fail | Fail if any check failed. |
| --fail-on-tool-change | Fail if a tool changed in a way that changes what an AI does (compared with the baseline, or the last run on this computer). |
| --baseline <file.json> | Compare with a saved report; fail if the score dropped or a check got worse. |
| --max-drop <points> | How far the score may fall below the baseline. Default 5. |
| --save-baseline <file> | Save this report to compare with next time. |
| --install-hook | Test this server on every git commit (see above). |
| --html <file.html> | A report page you can open and share. Works offline. |
| --json <file.json> | The full report as data. |
| --markdown <file.md> | A short report for pull-request comments. |
| --junit <file.xml> | A JUnit report for CI systems. |
| 0 | Fine. |
| 1 | A check you required failed (a CI gate). |
| 2 | Wrong options. |
| 3 | Could not test: the server is down or needs a login. |
Only Node.js 20 or newer. npx qamcp-cli downloads and runs the latest version for you.
No. It talks only to the server you test (and its login page, if it has one). No tracking, no telemetry.
Yes. Test it by its link if it runs on a port, or start it with --stdio, for example --stdio "uv run server.py".
It reads what a server says about itself, without calling any tool, and tells you in plain words about hidden instructions and which tools could change, send or delete things.