xka0085-byte/mcpreflight
Developer toolsこのページは AI により自動翻訳されています。技術的な詳細は原文をご確認ください。 原文を見る
Read-only MCP security scanner and schema checker, plus x402 HTTP 402 endpoint inspector for AI-agent developers and GitHub Actions.
概要
Read-only checks for MCP tool schemas and x402 payment endpoints. Use it before an agent client or buyer depends on an endpoint. Check an MCP server without calling any tools: Requires Node.js 18+. No API key or wallet is needed. Example schema run against a live endpoint: The exact same run against a healthy server prints Status: PASS and exits 0, so CI can gate on it. Exit codes are stable for automation: 0 PASS, 1 FAIL, 2 UNKNOWN/network error, 3 usage error. mcpreflight is a protocol- and schema-level preflight, not a security audit. It does not: - Detect malicious code, prompt injection, or supply-chain risk in the server's implementation - Call tools, so it cannot prove runtime behavior, data handling, or permission scope - Bypass, test, or evaluate authentication and authorization - Verify payment settlement or delivery for x402 endpoints - Certify compliance with any spec beyond the response shapes it inspects
README
以下は原文 README の抜粋です。原文を見る。
mcpreflight
Read-only checks for MCP tool schemas and x402 payment endpoints. Use it before an agent client or buyer depends on an endpoint.
What it is
Read-only MCP and x402 preflight: it reads initialize + tools/list and x402 payment documents. No API key, no wallet, no payment, no tool calls.
Start here
npx @eidonze/mcpreflight schema https://your-mcp-server.example/mcp --json
Exit codes are stable for CI: 0 PASS, 1 FAIL, 2 UNKNOWN/network, 3 usage. Requires Node.js 18+.
Gate a pull request:
- uses: xka0085-byte/mcpreflight@v1
with:
endpoint: https://your-mcp-server.example/mcp
Check your endpoint in the browser, free and without signup: check-your-mcp-endpoint
Find the right guide
- Public documentation site
- MCP schema checker
- x402 endpoint inspector
- MCP security CI
- Troubleshooting
- OAuth scope and current limits
Run it now
Check an MCP server without calling any tools:
npx @eidonze/mcpreflight schema https://your-mcp-server.example/mcp --json
Check an x402 endpoint without paying:
npx @eidonze/mcpreflight inspect https://your-api.example/paid --method=POST --json
Requires Node.js 18+. No API key or wallet is needed.
Example schema run against a live endpoint:
$ npx @eidonze/mcpreflight schema https://your-mcp-server.example/mcp
MCP Tool Schema Report
- Status: FAIL
- Endpoint: https://your-mcp-server.example/mcp
- Protocol: 2025-06-18
- Tools: 12
- FAIL REQUIRED_PROPERTY_UNDEFINED: tools[3] requires undeclared property query
- WARN PROPERTY_DESCRIPTION_MISSING: tools[7].limit has no description
The exact same run against a healthy server prints Status: PASS and exits 0, so CI can gate on it.
Which command?
| Command | Checks | Does not do |
|---|---|---|
schema |
MCP initialize, tools/list, tool names, descriptions, and JSON schemas |
Does not call tools or prove runtime behavior |
inspect |
HTTP 402, x402 v1/v2 payment document, accepts[], discovery manifests, latency and response digest |
Does not sign, pay, settle, retry, or verify delivery |
Exit codes are stable for automation: 0 PASS, 1 FAIL, 2 UNKNOWN/network error, 3 usage error.
インストール
npx @eidonze/mcpreflight schema https://your-mcp-server.example/mcp --json