MCP Validation Tool

A comprehensive validation tool for Model Context Protocol (MCP) servers to ensure protocol compliance, security, and proper implementation.

Goal

This tool validates MCP servers by:

• Protocol Compliance: Tests the complete MCP initialization handshake
• Standard Conformance: Validates JSON-RPC 2.0 format and required fields
• Capability Testing: Verifies advertised capabilities (resources, tools, prompts)
• Security Analysis: Integrates with mcp-scan for vulnerability detection
• Registry Validation: Ensures servers match their registry schema definitions
• Detailed Reporting: Exports comprehensive JSON reports with validation checklists
• Automated Testing: Provides programmatic validation for CI/CD pipelines

Features

• ✅ Protocol Validation: Complete MCP handshake and capability testing
• ✅ Multi-Transport Support: stdio, HTTP, and SSE transports with full OAuth 2.0 support
• ✅ OAuth 2.0 Authentication: Full OAuth 2.0 Dynamic Client Registration (RFC 7591)
• ✅ Automatic Browser Opening: Seamless OAuth authentication flow
• ✅ Security Scanning: Integrated mcp-scan vulnerability analysis
• ✅ JSON Reports: Comprehensive validation reports with linked security scans
• ✅ Step-by-Step Logging: Real-time validation progress with detailed feedback
• ✅ Tool Discovery: Lists all available tools, prompts, and resources
• ✅ Environment Variables: Configurable environment setup
• ✅ Timeout Handling: Configurable validation timeouts
• ✅ Exit Codes: Proper exit codes for automation
• ✅ Verbose Mode: Optional detailed output

Installation

# Clone and install
git clone https://github.com/modelcontextprotocol/mcp-validation
cd mcp-validation
uv sync

Or install directly:

pip install mcp-validation

Usage

Basic Validation

# Validate a Python MCP server (stdio transport)
mcp-validate -- python server.py

# Validate a Node.js MCP server (stdio transport)
mcp-validate -- node server.js

# Validate npx packages (use -- separator for flags)
mcp-validate -- npx -y kubernetes-mcp-server@latest

# Validate servers via container runtime (podman/docker)
mcp-validate -- podman run -i --rm hashicorp/terraform-mcp-server

HTTP Transport Validation

# Validate HTTP MCP servers with OAuth 2.0 Dynamic Client Registration
mcp-validate --transport http --endpoint https://example.com/api/mcp

# With pre-registered OAuth credentials
mcp-validate --transport http --endpoint https://gitlab.com/api/v4/mcp \
  --client-id YOUR_CLIENT_ID --client-secret YOUR_CLIENT_SECRET

# With personal access token
mcp-validate --transport http --endpoint https://api.example.com/mcp \
  --auth-token YOUR_ACCESS_TOKEN

# Local HTTP server
mcp-validate --transport http --endpoint http://localhost:3000/mcp

SSE Transport Validation

# Validate SSE endpoints with Bearer token authentication
mcp-validate --transport sse --endpoint https://mcp.example.com/sse --auth-token YOUR_TOKEN

# SSE endpoint without authentication
mcp-validate --transport sse --endpoint https://public.mcp.example.com/sse

Authentication

The tool supports different authentication methods depending on the transport:

SSE Transport: Simple Bearer token authentication HTTP Transport: Full OAuth 2.0 support with three authentication methods:

1. Dynamic Client Registration (Automatic)

# No credentials needed - automatic registration with the OAuth server
mcp-validate --transport http --endpoint https://gitlab.com/api/v4/mcp

# The tool will:
# - Automatically register a new OAuth client with the server
# - Open your browser for authorization
# - Handle the OAuth callback automatically
# - Continue with MCP validation

2. Pre-registered OAuth Application

# Use your existing OAuth application credentials
m

... [View full README on GitHub](https://github.com/RHEcosystemAppEng/mcp-validation#readme)