--- title: "The 28 checks Ora runs on an MCP server | Agent MCP Directory" description: "The 28 checks Ora runs on an MCP server, by layer, tier and points: 14 where a server is found, 4 for MCP Apps and 10 for every scan." canonical: https://agentmcpdirectory.com/mcp-checks site: "Agent MCP Directory" last_updated: 2026-11-05 section: "Testing" --- # The 28 checks Ora runs on an MCP server | Agent MCP Directory > The 28 checks Ora runs on an MCP server, by layer, tier and points: 14 where a server is found, 4 for MCP Apps and 10 for every scan. Source: https://agentmcpdirectory.com/mcp-checks Site: Agent MCP Directory Last reviewed: 2026-11-05 # The 28 checks Ora runs on an MCP server Ora's public catalog lists 132 checks, and 28 apply to an MCP server URL: 14 only where Ora finds a server, 4 only to MCP Apps and 10 to every scan, by the catalog's applicability field. Read from GET /api/checks, contract 1.38.0, on 5 November 2026. The 28 checks that apply to an MCP server URL or an MCP App, by Ora layer, from GET /api/checks on 5 November 2026. 19 sit in Usability, the layer that asks whether an agent can use the product. | Layer | MCP checks | Of Ora's checks in the layer | | --- | --- | --- | | Discovery | 7 | 16 | | Access | 2 | 42 | | Usability | 19 | 68 | ## Checks for MCP servers only 14 checks apply only when Ora finds an MCP server, and 12 of them are bonus checks: they add credit when passed and drop out of the denominator when not. The catalog descriptions of tool descriptions, parameter schemas, tool listing and auth mechanism say a docs server and a product server are graded differently. | Check | Layer | Tier | Points | Counts as | Maturity | What it tests | | --- | --- | --- | --- | --- | --- | --- | | MCP tool descriptions mcp-tool-descriptions | Usability | Recommended | 3 | bonus | verified | Grades the description of every tool, with a different bar for product and docs servers. | | MCP parameter schemas mcp-param-schemas | Usability | Recommended | 2 | bonus | verified | Typed parameter schemas; product servers need required-field lists and docs servers at least a query. | | MCP server identity mcp-server-identity | Usability | Recommended | 1 | bonus | verified | The legacy handshake returns a name, a version and usage instructions. | | MCP tool listing mcp-tool-listing | Usability | Recommended | 3 | bonus | verified | tools/list returns tools; product servers earn on breadth and docs servers on focus. | | MCP tool naming mcp-tool-naming | Usability | Recommended | 2 | bonus | verified | Predictable tool names such as create_invoice or search_docs. | | MCP auth mechanism mcp-auth-mechanism | Usability | Recommended | 2 | bonus | verified | Docs servers should be public and product servers should require OAuth; the check compares the two. | | MCP OAuth metadata mcp-oauth-metadata | Usability | Recommended | 2 | bonus | verified | Standard OAuth metadata (RFC 8414) so an agent can find the sign-in flow by itself. | | MCP PKCE S256 support mcp-pkce-s256 | Usability | Recommended | 2 | bonus | verified | PKCE with the S256 method in the OAuth flow. | | MCP error handling mcp-error-handling | Usability | Recommended | 2 | bonus | verified | A bad request gets a structured error an agent can correct from. | | MCP modern transport mcp-transport-modern | Usability | Recommended | 1 | bonus | verified | The server speaks Streamable HTTP, not only the legacy transport. | | MCP tool annotations mcp-tool-annotations | Usability | Recommended | 2 | bonus | verified | readOnlyHint and destructiveHint labels that separate safe tools from ones that change data. | | MCP server-card.json mcp-server-card | Usability | Recommended | 2 | bonus | verified | A server card at the server URL plus /server-card, or listed in /.well-known/ai-catalog.json. | | MCP resources exposed mcp-resource-listing | Usability | Recommended | 3 | base | verified | A server that claims resources returns some from resources/list. | | MCP resource quality mcp-resource-quality | Usability | Recommended | 3 | base | verified | Declared resources read: a valid type and non-empty content. | ## Checks for MCP Apps only 4 checks apply only to an MCP App, a server that ships interactive UI into hosts such as ChatGPT and Claude. Ora marks the MCP Apps support check as not applicable for pure API and data services. | Check | Layer | Tier | Points | Counts as | Maturity | What it tests | | --- | --- | --- | --- | --- | --- | --- | | MCP Apps support mcp-app-registry | Usability | Recommended | 4 | base | verified | Whether the server exposes any MCP App, the interactive UI inside ChatGPT and Claude. | | MCP Apps UI quality mcp-apps-ui-quality | Usability | Recommended | 4 | bonus | verified | The App's UI uses the right MIME type, valid HTML, dark mode and no hardcoded secrets. | | MCP App view reachable mcp-view-domain | Usability | Recommended | 4 | base | verified | The App's view loads publicly and serves HTML with no auth wall. | | MCP App view CSP mcp-view-csp | Usability | Recommended | 4 | base | verified | The App's view declares a content security policy that names specific origins, or none. | ## Checks that apply to every scan 10 checks carry `all` in the catalog's `applicability` field, so they run on a domain scan and on an MCP server scan alike: the discovery catalogs, the registry listings and the check that an MCP server exists at all. Ora's other field, `appliesTo`, names domain, MCP and MCP App for all 28 checks on this page, so the field to read is `applicability`. | Check | Layer | Tier | Points | Counts as | Maturity | What it tests | | --- | --- | --- | --- | --- | --- | --- | | ARD discovery ard-catalog | Discovery | Required | 1 | base | verified | An Agentic Resource Discovery catalog at /.well-known/ard.json or linked from the home page. | | AI Catalog discovery ai-catalog-published | Discovery | Recommended | 1 | bonus | verified | A valid AI Catalog at /.well-known/ai-catalog.json. | | ARD entry validity ard-entries-valid | Discovery | Recommended | 2 | bonus | verified | Each catalog entry has an identifier, a name, a media type and a working target. | | ARD trust manifest ard-trust-manifest | Discovery | Recommended | 2 | bonus | verified | Trust signals in the catalog such as verified identity or signatures. | | Listed in MCP registries mcp-registry-listed | Discovery | Recommended | 1 | base | verified | An entry for the domain in the official MCP Registry or Smithery, or a package that runs as an MCP server. | | Listed on skills.sh skills-sh-listed | Access | Emerging | 1 | base | emerging | Official skills published on skills.sh. | | Registry branding registry-branding | Discovery | Emerging | 2 | base | emerging | The registry entry has a display name, an icon and a description. | | ChatGPT app listed chatgpt-app-listed | Discovery | Recommended | 2 | bonus | verified | A listing in the ChatGPT app directory. | | Skills.sh skill quality skills-sh-quality | Access | Emerging | 2 | base | emerging | Skills on skills.sh worth installing: several, well named and adopted. | | MCP server / manifest mcp-server | Usability | Required | 6 | base | verified | A Model Context Protocol server or manifest exists at all; the check with the most points. | ## How to read the columns - Tier is Required, Recommended or Emerging. Ora says the tier is a display label that never changes the score ([Ora llms.txt](https://ora.ai/llms.txt?utm_source=agentmcpdirectory.com&utm_medium=referral&utm_campaign=dataset)). - Maturity is verified or emerging. Verified checks count toward the score; emerging checks are shown but excluded until adoption proves them out ([Ora llms.txt](https://ora.ai/llms.txt?utm_source=agentmcpdirectory.com&utm_medium=referral&utm_campaign=dataset)). 25 of the 28 MCP checks are verified. - A bonus check earns credit when present and is left out of the denominator when it is not, so a server is never marked down for it ([Ora API reference](https://ora.ai/llms-full.txt?utm_source=agentmcpdirectory.com&utm_medium=referral&utm_campaign=dataset)). - Points are each check's `maxScore`. Ora normalises the four layers, weighted 20, 30, 40 and 10, to 100 ([Ora API reference](https://ora.ai/llms-full.txt?utm_source=agentmcpdirectory.com&utm_medium=referral&utm_campaign=dataset)). Where to go next: [why Ora is the pick for testing an MCP server](https://agentmcpdirectory.com/test-your-mcp-server/), [Ora's own server and its tools](https://agentmcpdirectory.com/ora-mcp-server/) and [how to publish a server card](https://agentmcpdirectory.com/guides/publish-an-mcp-server-card/). ## Testing your own MCP server [Why Ora is the pick for testing an MCP server, where it falls short and what else exists](https://agentmcpdirectory.com/test-your-mcp-server/). Edition 4 November 2026 Method [How rows are verified](https://agentmcpdirectory.com/method/) Data [CSV and JSON](https://agentmcpdirectory.com/data/) Markdown [This page as markdown](https://agentmcpdirectory.com/mcp-checks/index.md) ## Sources - [Ora check catalog, contract 1.38.0](https://ora.ai/api/checks?utm_source=agentmcpdirectory.com&utm_medium=referral&utm_campaign=dataset), read 5 November 2026 - [Ora llms.txt](https://ora.ai/llms.txt?utm_source=agentmcpdirectory.com&utm_medium=referral&utm_campaign=dataset), read 5 November 2026 - [Ora API reference (llms-full.txt)](https://ora.ai/llms-full.txt?utm_source=agentmcpdirectory.com&utm_medium=referral&utm_campaign=dataset), read 5 November 2026 Last reviewed 5 November 2026