What QAmcp can and can't catch

A green report means QAmcp's checks passed on what it could test. It doesn't mean a server is safe. This page says exactly where that line is, so you can decide how much to trust a result.

Last updated 27 October 2026

What QAmcp catches

Connection and protocol problems: a server that won't connect, is on an older MCP version, or sends replies AI apps can't load.

Unclear tools: missing or vague descriptions, inputs with no description, tools that read almost the same.

Safety labels that are missing, or contradicted by the tool's own name, description or inputs.

Known hidden-instruction tricks in tool, resource and prompt descriptions, like <IMPORTANT> blocks, "don't tell the user" and invisible characters.

Bad input handling in tools it can safely run: a missing or wrong-type input that doesn't get a clear error.

Leaks in error messages from those tools: keys, passwords, tokens, server folders and stack traces.

Tools that crash, hang or answer too slowly, and answers too big for AI apps.

Login setup that doesn't follow the MCP spec, so AI apps can't sign in.

Changes: every tool, input and label that changed since the last test.

What QAmcp can't see

What happens behind the scenes. QAmcp sees what a server says and answers. It can't see whether a tool quietly writes a file, calls another service or reads something it shouldn't.

Tools it doesn't run. In safe mode, tools without a read-only label, tools that sound like they change things, and tools behind a login it doesn't have are only read, never run. The report lists them as "Not run".

A server that lies consistently. A tool with a clean name, a clean description and a false read-only label looks like any honest tool.

Behavior that only shows up sometimes: for certain users, inputs, dates or places, or after QAmcp has stopped looking.

New tricks. Hidden instructions written in a way QAmcp's list doesn't know yet.

Permissions between users, like whether user A can read user B's data. That needs two accounts on the server.

Attacks, like ../ path tricks or command injection. Sending those to someone else's server would be attacking it, so QAmcp doesn't.

The server's own code and packages: QAmcp doesn't scan source code or dependencies.

Two kinds of check, both shown with evidence

Measured

Some results come straight from what happened: the server connected or didn't, a tool answered in 1.4 seconds, an error message contained a key, a reply was missing a field the spec requires.

Rule-based

Others follow fixed rules about words, like "a read-only tool whose name starts with send" or "an input called sql". Rules can be wrong about an unusual tool, so the report always says which word or input set it off, and these are usually warnings, not failures.

Neither kind uses an AI. The same server gives the same result every time, and you can check every finding yourself. Every check and its points

How to read a report

Read the score with its coverage line, like Tested 10 of 10 checks · ran 5 of 9 tools. A 90 from 2 of 20 tools says much less than a 90 from all 20.

A pass means "no problem found" in what was tested, not "no problem exists".

For a server you don't trust yet, use --before-install or --look-only: they run no tools at all.

For your own server, owner mode runs more tools, and running QAmcp on every change catches problems the day they appear.