QAmcp

Copied. Paste it into Claude Code, Cursor or Codex:Fetch and follow the instructions at https://qamcp.dev/setup.md to test my MCP server.

Your AI finds your server in your project, tests it with QAmcp, explains what's wrong in plain words, fixes it with your OK, and tests again. Read the instructions

NewYour score can change any day. QAmcp Monitor tests your server every hour and emails you when it breaks. Free for 1 server.See what Monitor does →

Directory / Onhand

Onhand

Q: Is Onhand MCP server safe?

QAmcp's test on 2 Nov 2026: None of the hidden-instruction wordings we know were found in its tool descriptions. Its error messages showed no secrets or internal details. 17 of its 36 tools are labeled read-only; the others may change or send things. Overall it scored 88/100 on 2 Nov 2026. A test can only see what the server shows from outside, not what it does with your data behind the scenes. Connect servers from makers you trust.

by askonhand.com · https://mcp.askonhand.com/mcp/onhand

MCP server for local business availability: in-stock items, open appointment slots and shop hours

36 tools✓ no account neededPricing: not listed

Visit website

88 /100

FAIL

11 of 11 checks · 2 Nov 2026

Is Onhand MCP server safe?

None of the hidden-instruction wordings we know were found in its tool descriptions.
Its error messages showed no secrets or internal details.
17 of its 36 tools are labeled read-only; the others may change or send things.
Overall it scored 88/100 on 2 Nov 2026.

A test can only see what the server shows from outside, not what it does with your data behind the scenes. Connect servers from makers you trust.

What it can do

36 tools, in the server's own words.

discover_localread-only

Searches matching offerings and nearby directory businesses together.

search_local_offeringsread-only

Searches items and services near a point.

get_open_slotsread-only

Next open appointment windows at one business, soonest first.

get_companyread-only

Return the authenticated merchant's own company.

list_locationsread-only

Where the authenticated merchant trades.

list_connectionsread-only

The merchant's connected point-of-sale and catalog sources, and whether each is syncing.

get_subscriptionread-only

What the merchant's organization is paying for.

update_company_profile

Stage a change to the merchant's own listing: name, website, phone, or categories.

confirm_update_company_profile

Apply a listing change staged by update_company_profile.

update_hours

Stage new opening hours for one of the merchant's own locations.

get_connection_linkread-only

Where the merchant connects, reconnects, maps the locations of, or disconnects a point-of-sale or catalog source, plus a sentence saying what happens there.

get_billing_linkread-only

Where the merchant manages their subscription.

confirm_update_hours

Apply opening hours staged by update_hours.

list_subjectsread-only

List the organizations this sign-in belongs to.

select_subject

Choose which of this person's organizations later merchant tools act for.

setup_account

Create this sign-in's account before any business exists.

start_business_claim

After setup_account with kind claim, point at a live business and return the page where the person proves control.

prepare_booking

Prepare a reservation or appointment.

confirm_booking

Confirms one prepared booking once using the intent from prepare_booking.

prepare_booking_cancellation

Prepare cancellation only for a Square appointment Onhand created for this shopper.

confirm_booking_cancellation

Confirm one prepared Square cancellation.

prepare_checkout

Prepare checkout for one currently available item.

confirm_checkout_handoff

Confirms a prepared checkout once using the intent from prepare_checkout.

prepare_quote_request

Prepare a handoff to a currently verified quote destination and show exactly where the shopper will continue.

and 12 more

Test results

Safe mode: only tools labeled read-only were run. How the test works

✕
Fast enough
1 failed
- ✕find_business: Slowest tool: find_business (15.1 s): most users will give up waiting
- and 3 more
fail
!
Every tool is described
34 warnings
- !discover_local: Inputs with no description: lat, lng, q, radius_m, city, attributes, category, research_fact_types
- !search_local_offerings: Inputs with no description: lat, lng, q, radius_m, city, attributes
- !get_open_slots: Inputs with no description: business_id, offering_id, limit
- !update_company_profile: Inputs with no description: display_name, website, phone, categories, idempotency_key
- !confirm_update_company_profile: Inputs with no description: intent
- !update_hours: Inputs with no description: location_id, hours, idempotency_key
- !get_connection_link: Inputs with no description: provider, action
- !confirm_update_hours: Inputs with no description: intent
- and 26 more
note
!
Follows MCP best practices (not scored yet)
1 tip (not scored)
- !3 tools answer with structured data but don't declare its shape (outputSchema): discover_local, search_local_offerings, find_nearby_businesses. If those answers change shape, nothing can catch it; with a schema, every answer is checked.
note
✓
ConnectsConnected in 191 ms
pass
✓
Ready for the newest MCP versionUses the latest MCP version (2026-07-28)
pass
✓
Lists its toolsFound 36 tools
pass
✓
Tools are labeled safe or dangerousEvery tool has a safety label
pass
✓
No known hidden instructionsNone of the hidden-instruction wordings we know were found in tool descriptions. New wordings can get past this check.
pass
✓
Tools work with good inputs
All good
- ✓discover_local: Worked (539 ms)
- ✓search_local_offerings: Worked (132 ms)
- ✓get_open_slots: Answered with an error, probably because of our sample input: Input validation error: Invalid arguments for tool get_open_slots: business_id: Invalid UUID
- –get_company: Needs you to sign in, so it was not tested (not counted against the server)
- –list_locations: Needs you to sign in, so it was not tested (not counted against the server)
- –list_connections: Needs you to sign in, so it was not tested (not counted against the server)
- –get_subscription: Needs you to sign in, so it was not tested (not counted against the server)
- –get_connection_link: Needs you to sign in, so it was not tested (not counted against the server)
- and 28 more
pass
✓
Bad inputs give a clean error
All good
- ✓discover_local: Refused missing required input "lat" with a clear error
- ✓discover_local: Refused wrong type for "lat" with a clear error
- ✓search_local_offerings: Refused missing required input "lat" with a clear error
- ✓search_local_offerings: Refused wrong type for "lat" with a clear error
- ✓get_open_slots: Refused missing required input "business_id" with a clear error
- ✓get_open_slots: Refused wrong type for "business_id" with a clear error
- –get_connection_link: Needs you to sign in, so bad inputs were not tested
- –get_action_status: Needs you to sign in, so bad inputs were not tested
- and 12 more
pass
✓
No secrets leakedChecked 36 error messages: no secrets or internal details
pass
–
Tools work togetherNo tool's answer could be fed into another tool, so there were no chains to test (not counted either way)
not tested

Test it yourself

Free and open source. Same checks, same score.

npx qamcp-cli https://mcp.askonhand.com/mcp/onhand

Show this score on GitHub

Free for every server in the directory. Paste this into your README: the badge shows the score from our latest test.

[![QAmcp score](https://qamcp.dev/s/com-askonhand-onhand.svg)](https://qamcp.dev/s/com-askonhand-onhand.html)

Score over time

2 Nov 202688

One test so far. New tests will show here.

Reviews

Coming soon: reviews from people who use Onhand, signed in with GitHub, one per person. Reviews never change the score.

Is this your server? Get an alert the moment it breaks.

QAmcp Monitor tests it every hour and emails you when it goes down, the score drops, a tool changes or a secret leaks. Free for 1 server, no card.

Have a concern, or want it removed? Ask us and we'll take it off the list. How the directory works