The 28 checks Ora runs on an MCP server
Ora's public catalog lists 132 checks, and 28 apply to an MCP server URL: 14 only where Ora finds a server, 4 only to MCP Apps and 10 to every scan, by the catalog's applicability field. Read from GET /api/checks, contract 1.38.0, on 5 November 2026.
| Layer | MCP checks | Of Ora's checks in the layer |
|---|---|---|
| Discovery | 7 | 16 |
| Access | 2 | 42 |
| Usability | 19 | 68 |
Checks for MCP servers only
14 checks apply only when Ora finds an MCP server, and 12 of them are bonus checks: they add credit when passed and drop out of the denominator when not. The catalog descriptions of tool descriptions, parameter schemas, tool listing and auth mechanism say a docs server and a product server are graded differently.
| Check | Layer | Tier | Points | Counts as | Maturity | What it tests |
|---|---|---|---|---|---|---|
| MCP tool descriptions mcp-tool-descriptions | Usability | Recommended | 3 | bonus | verified | Grades the description of every tool, with a different bar for product and docs servers. |
| MCP parameter schemas mcp-param-schemas | Usability | Recommended | 2 | bonus | verified | Typed parameter schemas; product servers need required-field lists and docs servers at least a query. |
| MCP server identity mcp-server-identity | Usability | Recommended | 1 | bonus | verified | The legacy handshake returns a name, a version and usage instructions. |
| MCP tool listing mcp-tool-listing | Usability | Recommended | 3 | bonus | verified | tools/list returns tools; product servers earn on breadth and docs servers on focus. |
| MCP tool naming mcp-tool-naming | Usability | Recommended | 2 | bonus | verified | Predictable tool names such as create_invoice or search_docs. |
| MCP auth mechanism mcp-auth-mechanism | Usability | Recommended | 2 | bonus | verified | Docs servers should be public and product servers should require OAuth; the check compares the two. |
| MCP OAuth metadata mcp-oauth-metadata | Usability | Recommended | 2 | bonus | verified | Standard OAuth metadata (RFC 8414) so an agent can find the sign-in flow by itself. |
| MCP PKCE S256 support mcp-pkce-s256 | Usability | Recommended | 2 | bonus | verified | PKCE with the S256 method in the OAuth flow. |
| MCP error handling mcp-error-handling | Usability | Recommended | 2 | bonus | verified | A bad request gets a structured error an agent can correct from. |
| MCP modern transport mcp-transport-modern | Usability | Recommended | 1 | bonus | verified | The server speaks Streamable HTTP, not only the legacy transport. |
| MCP tool annotations mcp-tool-annotations | Usability | Recommended | 2 | bonus | verified | readOnlyHint and destructiveHint labels that separate safe tools from ones that change data. |
| MCP server-card.json mcp-server-card | Usability | Recommended | 2 | bonus | verified | A server card at the server URL plus /server-card, or listed in /.well-known/ai-catalog.json. |
| MCP resources exposed mcp-resource-listing | Usability | Recommended | 3 | base | verified | A server that claims resources returns some from resources/list. |
| MCP resource quality mcp-resource-quality | Usability | Recommended | 3 | base | verified | Declared resources read: a valid type and non-empty content. |
Checks for MCP Apps only
4 checks apply only to an MCP App, a server that ships interactive UI into hosts such as ChatGPT and Claude. Ora marks the MCP Apps support check as not applicable for pure API and data services.
| Check | Layer | Tier | Points | Counts as | Maturity | What it tests |
|---|---|---|---|---|---|---|
| MCP Apps support mcp-app-registry | Usability | Recommended | 4 | base | verified | Whether the server exposes any MCP App, the interactive UI inside ChatGPT and Claude. |
| MCP Apps UI quality mcp-apps-ui-quality | Usability | Recommended | 4 | bonus | verified | The App's UI uses the right MIME type, valid HTML, dark mode and no hardcoded secrets. |
| MCP App view reachable mcp-view-domain | Usability | Recommended | 4 | base | verified | The App's view loads publicly and serves HTML with no auth wall. |
| MCP App view CSP mcp-view-csp | Usability | Recommended | 4 | base | verified | The App's view declares a content security policy that names specific origins, or none. |
Checks that apply to every scan
10 checks carry all in the catalog's applicability field, so they run on a domain scan and on an MCP server scan alike: the discovery catalogs, the registry listings and the check that an MCP server exists at all. Ora's other field, appliesTo, names domain, MCP and MCP App for all 28 checks on this page, so the field to read is applicability.
| Check | Layer | Tier | Points | Counts as | Maturity | What it tests |
|---|---|---|---|---|---|---|
| ARD discovery ard-catalog | Discovery | Required | 1 | base | verified | An Agentic Resource Discovery catalog at /.well-known/ard.json or linked from the home page. |
| AI Catalog discovery ai-catalog-published | Discovery | Recommended | 1 | bonus | verified | A valid AI Catalog at /.well-known/ai-catalog.json. |
| ARD entry validity ard-entries-valid | Discovery | Recommended | 2 | bonus | verified | Each catalog entry has an identifier, a name, a media type and a working target. |
| ARD trust manifest ard-trust-manifest | Discovery | Recommended | 2 | bonus | verified | Trust signals in the catalog such as verified identity or signatures. |
| Listed in MCP registries mcp-registry-listed | Discovery | Recommended | 1 | base | verified | An entry for the domain in the official MCP Registry or Smithery, or a package that runs as an MCP server. |
| Listed on skills.sh skills-sh-listed | Access | Emerging | 1 | base | emerging | Official skills published on skills.sh. |
| Registry branding registry-branding | Discovery | Emerging | 2 | base | emerging | The registry entry has a display name, an icon and a description. |
| ChatGPT app listed chatgpt-app-listed | Discovery | Recommended | 2 | bonus | verified | A listing in the ChatGPT app directory. |
| Skills.sh skill quality skills-sh-quality | Access | Emerging | 2 | base | emerging | Skills on skills.sh worth installing: several, well named and adopted. |
| MCP server / manifest mcp-server | Usability | Required | 6 | base | verified | A Model Context Protocol server or manifest exists at all; the check with the most points. |
How to read the columns
- Tier is Required, Recommended or Emerging. Ora says the tier is a display label that never changes the score (Ora llms.txt).
- Maturity is verified or emerging. Verified checks count toward the score; emerging checks are shown but excluded until adoption proves them out (Ora llms.txt). 25 of the 28 MCP checks are verified.
- A bonus check earns credit when present and is left out of the denominator when it is not, so a server is never marked down for it (Ora API reference).
- Points are each check's
maxScore. Ora normalises the four layers, weighted 20, 30, 40 and 10, to 100 (Ora API reference).
Where to go next: why Ora is the pick for testing an MCP server, Ora's own server and its tools and how to publish a server card.