只读MCP安全扫描器和模式检查器，以及为AI代理开发者提供x402 HTTP 402端点检查器和GitHub Actions。
概览
只读检查MCP工具架构和x402支付端点。在代理人、客户或买家依赖某个端点之前使用它。 在不调用任何工具的情况下检查MCP服务器： 需要Node.js 18+。不需要API密钥或钱包。 针对活端点运行的示例模式： 同样的运行在健康服务器上会打印状态：PASS，退出0，所以CI可以对它进行门禁。 自动化的退出代码是稳定的：0 PASS，1 FAIL，2 UNKNOWN/网络错误，3 使用错误。 MCPREFLIGHT是协议和模式层级的预检验，而非安全审计。它不： - 检测服务器实现中的恶意代码、提示注入或供应链风险 - 调用工具，使其无法证明运行时行为、数据处理或权限范围 - 绕过、测试或评估认证和授权 - 验证x402端点的支付结算或交付 - 认证其符合任何规范，超出其检查的响应形态
概述（AI 翻译）
只读检查MCP工具架构和x402支付端点。在代理人、客户或买家依赖某个端点之前使用它。
这是什么
只读MCP和x402预检：它读取initialize + tools/list和x402支付文档。没有API密钥，没有钱包，没有支付，也没有工具调用。
从这里开始
CI的出口码稳定：0 PASS，1 FAIL，2 未知/网络，3 使用情况。需要Node.js 18+。
启动请求门槛：
在浏览器中查看你的端点，免费且无需注册： 检查-your-mcp-endpoint
找到合适的向导
- 公共文献网站
- MCP 模式检查器
- x402端点检查器
- MCP 安全配置
- 故障排除
- OAuth 范围和电流限制
现在就播
在不调用任何工具的情况下检查MCP服务器：
无需付费即可检查x402终端：
需要Node.js 18+。不需要API密钥或钱包。
针对活端点运行的示例模式：
同样的运行对健康服务器会打印Status: PASS，退出为0，所以CI可以对它进行门禁。
哪个命令？
| 命令 | 检查 | 不做 |
|---|
本页由 AI 翻译，技术细节请以原文为准。
README
以下为原文 README 节选，完整内容请查看原文。
mcpreflight
Read-only checks for MCP tool schemas and x402 payment endpoints. Ships as a CLI, a GitHub Action, and a stdio MCP server that an agent client can call directly. Use it before an agent client or buyer depends on an endpoint.
What it is
Read-only MCP and x402 preflight: it reads initialize + tools/list and x402 payment documents. No API key, no wallet, no payment, no tool calls.
This is an endpoint preflight, not a source audit. Tools that read your repository or fuzz a server you launch need a checkout and a start command; this one needs only a URL, so it can check the deployment an agent is about to connect to, including one you do not own.
Check an endpoint you do not own
The same read-only check runs weekly against every remote endpoint listed in the official MCP Registry, and the results are published as pages and as JSON:
- Trust Directory — 35,325 endpoints, one report each: status, protocol version, tool count, findings, and whether credentials are required.
- JSON API —
/trust/api/{slug}.jsonper endpoint, plus batch indexes and a JSON Schema. No key, no signup, no rate limit. - x402 census dataset — the payment slice of the same sweep: 1,583 of 35,327 endpoints advertise x402 or HTTP-402, with a weekly series, a status distribution against the registry-wide baseline, and downloadable CSV/JSON.
Read the vocabulary before quoting any number: in the 2026-11-02 scan, 20,701 endpoints answered anonymously (PASS), 10,236 refused with 401 because they require credentials by design (AUTH_GATED), 167 were reachable but invalid (FAIL), and 4,223 gave no anonymous handshake (UNKNOWN, usually an auth wall we cannot see past). A “dead MCP servers” count taken from this data would be wrong — 41% of the registry cannot be checked without credentials at all.
Use it as an MCP server
The stdio entry point is bin/mcpreflight-mcp.mjs, published as the mcpreflight-mcp bin in the same npm package. It implements the MCP lifecycle a client expects: initialize returns serverInfo mcpreflight with the package version, notifications/initialized is accepted, and tools/list returns two tools.
| Tool | What it does |
|---|
安装
npx -y -p @eidonze/mcpreflight mcpreflight-mcp配置
{
"mcpServers": {
"mcpreflight": {
"command": "npx",
"args": ["-y", "-p", "@eidonze/mcpreflight", "mcpreflight-mcp"]
}
}
}