# QAmcp

> QAmcp is a free, open-source (MIT) tool to test and audit MCP (Model Context Protocol) servers. It connects to a server the way an AI app does and reports, in plain words, what is broken: connection, tool descriptions, safety labels, hidden instructions in tool descriptions, bad-input handling, leaked secrets in error messages, speed, login (OAuth) setup, resources and prompts. Every result is checked by code and shows its evidence (pass or fail, milliseconds, exact matches, or the words in a name or description that triggered a finding); no AI judges the results. What it can and cannot catch: https://qamcp.dev/limits.html

How to use it:

- In the browser, no install: https://qamcp.dev/test.html (paste a server link, press Test it)
- In a terminal: `npx qamcp-cli https://your-server.com/mcp` (or `npx qamcp-cli --stdio "your command"` for a local server)
- Before installing someone else's server: `npx qamcp-cli <link> --before-install`
- On every commit: `npx qamcp-cli --install-hook --stdio "npm start"`
- On every pull request: the GitHub Action `QAmcp/qamcp-cli@v0`

Safety: by default it only runs tools the server labels read-only, never runs tools that sound destructive, and sends nothing anywhere except to the server being tested. No tracking, no telemetry.

## Pages

- [Test a server in the browser](https://qamcp.dev/test.html): free, same checks and score as the CLI
- [Directory](https://qamcp.dev/directory.html): public MCP servers tested by QAmcp, with scores and every finding; updated daily
- [How to test and audit an MCP server](https://qamcp.dev/how-to-test-mcp-server.html): a step-by-step checklist (connection, descriptions, safety labels, hidden instructions, bad inputs, leaks)
- [MCP server not working?](https://qamcp.dev/mcp-server-not-working.html): fixes for servers that won't connect or show no tools in Cursor, Claude Desktop or VS Code
- [QAmcp in the terminal](https://qamcp.dev/cli.html): every command and option of npx qamcp-cli
- [How it works](https://qamcp.dev/how-it-works.html): every check and how the 0-100 score is calculated
- [Safety and privacy](https://qamcp.dev/safety.html): what QAmcp touches and what it never does
- [Run it in CI](https://qamcp.dev/ci.html): GitHub Action and other CI systems
- [Sample reports](https://qamcp.dev/samples.html): a deliberately broken server, a login wall, and a perfect score
- [State of MCP servers, October 2026](https://qamcp.dev/state-of-mcp-2026-10.html): what we found testing 365 public MCP servers; numbers as open data (CC BY 4.0) at https://qamcp.dev/state-of-mcp-2026-10.json
- [Pricing](https://qamcp.dev/pricing.html): testing is free; Monitor is free for 1 server, Pro is $19 a month founding price (3 servers, 5-minute checks, Slack)
- [Terms](https://qamcp.dev/terms.html) and [refunds](https://qamcp.dev/refund.html): 7-day money back on the first payment, cancel any time
- [QAmcp Monitor](https://qamcp.dev/monitor.html): coming soon: an up check every 5 minutes, the full test every hour, and an email when a server goes down, its score drops, a tool changes or a secret leaks
- [What QAmcp can and can't catch](https://qamcp.dev/limits.html): what a result covers, what it cannot see (behind-the-scenes side effects, tools not run, attacks), and how to read a green report
- [Security and data](https://qamcp.dev/security.html): for security teams: where data goes in the terminal tool, the website test and Monitor; what QAmcp keeps and never does
- [Directory rules](https://qamcp.dev/directory-rules.html): how servers are listed and ranked; scores are never changed for money
- [Privacy and terms](https://qamcp.dev/privacy.html) · [Contact](https://qamcp.dev/contact.html): hi@qamcp.dev

## For AI agents

- [setup.md](https://qamcp.dev/setup.md): step-by-step instructions for a coding agent to test and fix an MCP server with QAmcp

## Source

- [GitHub: QAmcp/qamcp-cli](https://github.com/QAmcp/qamcp-cli)
- [npm: qamcp-cli](https://www.npmjs.com/package/qamcp-cli)