Can I check an MCP server I do not control?

Yes — black-box probes such as mcp-spec-check need only a URL. Most of their checks require an authenticated session, so against a server you cannot authenticate to, expect a thin report rather than a verdict.

Which MCP tools are safe to use in a commercial product?

Check the licence first. Most are MIT or Apache-2.0, but MCP Linker is AGPL-3.0 and MCPHub is GPL-3.0. Maybe Don't AI, MCP Router and Toolbase are hosted services with no source to audit.

MCP Server Tooling: Testing, Securing, and Managing Your MCP Stack

Q: What is the difference between a scanner and a gateway?

A scanner inspects a server and reports findings — a point-in-time audit. A gateway sits in the request path permanently and enforces policy. Auditing tells you the server was fine on Tuesday; a gateway is what stops a call on Friday.

Once you run more than one MCP server, the protocol stops being the interesting part and the operations start. Is this server actually spec-compliant, or does it merely work with the one client you tested? What is it sending over JSON-RPC when a tool call misbehaves? Who is allowed to call it? How do you stop a poisoned tool description from reaching your agent?

The servers get the attention. The tooling around them is where the time goes. Fifteen such tools are catalogued below, grouped by the problem they solve. Three of them are hosted products rather than code you can audit, and two carry copyleft licences — both facts matter more than category membership if you are putting these in front of production credentials.

Some links to project repositories carry a referral parameter. It costs you nothing, changes nothing about what appears here, and the ordering below is by problem area, not by whether a link earns anything.

The fifteen tools at a glance

Tool	Problem it solves	Hosting	Language	License	★
mcp-spec-check	Black-box spec-compliance probe against a remote server URL	Self-hosted CLI	TypeScript	MIT	14
mcpsnoop	Transparent proxy showing live JSON-RPC traffic	Self-hosted	Go	MIT	318
mcp-watch	Scans for credential leaks, tool poisoning, injection vectors	Self-hosted CLI	TypeScript	MIT	135
mcp-proxy	Adds OAuth 2.0 (PKCE) in front of servers with no auth	Self-hosted	Go	MIT	1
Webrix Secure MCP Gateway	One OAuth-gated entry point fronting several servers	Self-hosted	TypeScript	MIT	20
Maybe Don't AI	Policy checks on agent calls before execution	Hosted product	—	—	—
template-mcp-server	CLI scaffold for a FastMCP-based project	Self-hosted CLI	JavaScript	MIT	76
ToolHive	Runs any MCP server in an isolated container with its own identity	Self-hosted	Go	Apache-2.0	1981
MCP Plexus	Framework for multi-tenant MCP servers	Self-hosted	Python	Apache-2.0	30
MCPToolGroups	Annotation-driven tool registration, hierarchical groups	Self-hosted	Java	Apache-2.0	2
MCP Linker	Install and sync servers across clients without editing JSON	Self-hosted	TypeScript	AGPL-3.0	323
MCPHub Desktop	Desktop manager for installed servers	Self-hosted	TypeScript	GPL-3.0	150
MCP Router	Routing and management across servers	Hosted product	—	—	—
Toolbase	Managed install/config layer for MCP clients	Hosted product	—	—	—
Observal	Self-hosted control plane and registry for agents, skills, servers	Self-hosted	Python	Apache-2.0	2248

Star counts and licences read from the GitHub API on 2026-07-30.

What counts as MCP tooling, and what is just an MCP server?

An MCP server exposes capabilities to an agent: it implements the Model Context Protocol and answers tools/list, resources/list and the rest. MCP tooling is everything that acts on those servers without being one — it tests them, proxies them, scans them, containerises them, or installs them.

The boundary is genuinely blurry, and pretending otherwise would be dishonest: clidey-deptrust, for example, is both a dependency-checking CLI and an MCP server exposing that CLI. The practical test used here is what the thing is for. If you would run it to make a server better, safer, or easier to operate, it is tooling. If you would run it to give an agent a new capability, it is a server — and belongs in a catalogue of servers, not in this list.

Testing and debugging MCP servers

mcp-spec-check black-box probes a remote MCP server URL and reports spec compliance in about thirty seconds. No source access needed, which makes it the fastest way to assess a server you did not write.

mcpsnoop is a transparent proxy between client and server that shows every JSON-RPC call live. When a tool call fails for reasons the client's error message does not explain, this is the layer you want.

What we found running it ourselves. We pointed mcp-spec-check at one of our own MCP servers (in SSE mode, dummy credentials, bound to localhost). One decided result came back without any authenticated access:

▲ OAuth protected-resource metadata discoverable — WARN
  the endpoint requires authorization but publishes no RFC 9728
  protected-resource metadata at any well-known path
0 pass · 1 warn · 7 skipped        exit 2

Seven of eight checks require an authenticated session, so an unauthenticated probe tells you comparatively little — worth knowing before you budget time for it. The one check that does return is a real finding: RFC 9728 defines OAuth 2.0 Protected Resource Metadata, and a server that demands authorization without advertising where to get it forces every client to hard-code what it should be able to discover.

Security and policy enforcement

mcp-watch scans MCP servers for credential leaks, tool poisoning, and prompt-injection vectors.

mcp-proxy is a Go proxy adding OAuth 2.0 (PKCE) in front of servers that ship no auth of their own. At 1 star it is effectively unadopted — read the code before relying on it.

Webrix Secure MCP Gateway is a self-hosted OAuth gateway fronting multiple servers behind a single entry point.

Maybe Don't AI enforces policy checks on agent calls before they execute. It is a hosted product, not a repository — the only one in this group you cannot audit.

Building and isolating servers

template-mcp-server is a CLI scaffold generating a FastMCP-based project.

ToolHive runs any MCP server in an isolated container with its own identity — the answer to "I do not trust this server with my filesystem". At 1981 stars it is the most adopted tool in this list.

MCP Plexus is a Python/FastMCP framework for multi-tenant servers.

MCPToolGroups does annotation-driven tool registration with hierarchical groups, for Java/OSGi stacks.

Managing and discovering servers

MCP Linker (AGPL-3.0), MCPHub Desktop (GPL-3.0), MCP Router and Toolbase all attack the same problem from different angles: installing and syncing servers across clients without hand-editing JSON config. They differ on platform, on whether they sync across machines, and — decisively for company use — on licence and on whether they are code at all. Linker and MCPHub are copyleft; Router and Toolbase are hosted products.

Observal is a self-hosted control plane and registry for internal agents, skills, and MCP servers — the option when the list is organisational rather than personal.

Doing this natively

The tooling above matters once the servers are chosen. If the job is finding and installing a server in the first place, that comes from the catalogue:

Spark MCP Server — search catalogue assets from inside the assistant
MCP Discovery ToolSpec — the agent queries a discovery server and finds other MCP servers itself
MCP ToolSpec — connect an agent to an arbitrary MCP server
EVC Mesh MCP — task management as an MCP server

FAQ

Do I need any of this to run a single MCP server?
No. One server, one client, one machine — the client's own logs are enough. This tooling starts paying off at the point where you cannot answer "which server sent that?" from memory, or where a server you did not write gets access to something that matters.

What is the difference between a scanner and a gateway here?
A scanner (mcp-watch) inspects a server and reports what it finds — a point-in-time audit. A gateway (Webrix, mcp-proxy) sits in the request path permanently and enforces something. Auditing a server tells you it was fine on Tuesday; a gateway is what stops a call on Friday.

Can I check a server I do not control?
Yes, that is exactly what black-box probes are for. mcp-spec-check needs only a URL. Note that most of its checks require an authenticated session — against a server you cannot authenticate to, expect a thin report rather than a verdict.

Which of these are safe to put in a commercial product?
Check the licence column before the feature list. Most are MIT or Apache-2.0, but MCP Linker is AGPL-3.0 and MCPHub is GPL-3.0. Three entries — Maybe Don't AI, MCP Router, Toolbase — are hosted services with no source to audit at all.