Test your MCP server for agents

Scan your MCP server with Ora first: 28 of its 132 public checks apply to an MCP server URL, and it needs no account. Use MCP Inspector to debug single calls and a security scanner for injection risks. Ora's limits are listed on this page, with alternatives for what it does not cover.

Ora

The pick for a first check of an MCP server, on the facts read on 5 November 2026. Ora's scan documentation.

Where it stops: public URLs only, no repeat-scan data published, the fixing product behind a waitlist and 10 scans a minute per IP. The full list.

Why Ora is the pick

It scans an MCP server URL directly. Ora's API reference says the url parameter of POST /api/scan takes a domain, an MCP server URL or an MCP App URL, and the scan_domain tool adds an optional mcpUrl (Ora API reference, read 5 November 2026).
Its catalog is public and counts the MCP part. The catalog's applicability field splits the 28 checks that name MCP as a target: 14 apply only where Ora finds an MCP server (mcp), 4 only to an MCP App (mcp-app) and 10 to every scan (all), among them the ARD catalog and the registry listing (GET /api/checks, contract 1.38.0). The list.
Check sets depend on the kind of server. When a domain ships more than one MCP server, Ora classifies each as product, docs or other and scores it with a check set for that kind (Ora API reference). Its own two servers declare their kind in a server card: product for ora.ai/api/mcp and docs for ora.ai/api/docs/mcp (main card, docs card).
A failing check says what to do. Every one of the 28 MCP checks carries a recommendation in the catalog, and POST /api/scan/checks re-runs only the check ids you name, never from a cache, so a fix can be confirmed without a full scan (Ora API reference).
It runs from outside, as an agent would. Ora fetches public URLs only; a local server needs a tunnel, and Ora's CLI can start one with --tunnel-cmd (Ora MCP page, Ora CLI docs).
It costs nothing to start. Ora's pricing endpoint lists one Free plan at 0 USD with 10 scans per minute and unlimited score lookups (pricing, read 5 November 2026).
It is an open MCP server itself. The connector listed 18 tools on https://ora.ai/api/mcp on 4 November 2026 with no credentials, including scan_domain, run_checks and list_checks, so an agent can test a server on your behalf (the row).

What Ora does not do

Public URLs only. Ora cannot scan private or internal sites or anything behind a login, and a scan of an MCP server that requires authentication returns MCP_AUTH_REQUIRED with no score or grade (Ora llms.txt, read 5 November 2026). In this directory 533 companies answered with a sign-in challenge, and a server like those cannot be scored from outside.
It is not a security audit. Ora's documentation lists security audits among the uses it is not suited for (Ora API reference); the scanners below cover prompt injection and tool poisoning.
No repeat-scan data is published. Ora says the same scan run twice converges within a couple of points, in its Deep Scan post of 8 April 2026, and shows no repeat-scan measurements (Ora blog).
The limit is 10 a minute. Ora's pricing lists unlimited score lookups, while its MCP page says 10 scans and 10 score reads a minute per IP (pricing, Ora MCP page). Ora's API reference says a 429 answer carries a Retry-After header to wait for (Ora API reference).
The score moves when the checks move. Ora's own FAQ answers a changed score with "the checks moved" and says rescanning scores you against the current set (Ora MCP page).
The fixing product is behind a waitlist. Ora's home page says it fixes what it finds and is rolling access out slowly; the scan, the per-check recommendations and generate_agent_files need no waitlist (Ora home page, read 5 November 2026).

Other ways to test an MCP server

Each row below says what the tool's own page says it does, labelled as the vendor's claim, and what it needs. Each tool answers its own question, and its scores or findings are not comparable with Ora's.

Tools that test an MCP server, read 5 November 2026
Tool	Use it for	What its own page says	What it needs
Ora	A first check of how agents find, read and use the server, with a fix for each failing check.	Ora runs 28 MCP checks and scores a docs server and a product server on different bars.	A public URL. No account.
MCP Inspector	Debugging one server by hand, or a connect, list, call, assert loop in a shell or CI job.	The project describes it as a developer tool for inspecting MCP servers, shipped as one package with a web UI, a scriptable CLI, a terminal UI and an experimental connection CLI. It keeps OAuth tokens in the operating system's keychain where there is one.	Node: `npx @modelcontextprotocol/inspector`. The README describes inspecting servers, not scoring them.
Manufact (mcp-use)	Debugging in the browser and a quality score, if the server is hosted with Manufact.	Manufact says it offers an MCP Quality Score, a server tunnel for local MCP servers and an mcp-use Inspector for debugging in the browser. Its catalog ranks servers by its own quality score.	Manufact Cloud for the hosted features; the mcp-use SDK is open source.
Snyk Agent Scan	Checking MCP servers, tools, prompts, resources and skills for prompt injection and other risks.	Snyk calls it a security scanner for AI agents, MCP servers and agent skills. It is open source under Apache-2.0 and accepts a path to OAuth tokens for remote servers behind sign-in.	A Snyk API token before any scan; component details go to the Agent Scan API. Installed with uvx, not npm.
Cisco MCP Scanner	Checking an MCP server's tools, prompts and resources for malicious content, offline if you accept YARA rules alone.	Cisco combines YARA rules, an LLM judge and the Cisco AI Defense inspect API; the analyzers can run one at a time, and the README shows a YARA-only CI example that needs no API keys.	Python. The API analyzer needs Cisco AI Defense access and the LLM analyzer a model provider.
Enkrypt AI MCP Scanner	A commercial inventory of MCP servers and tools with risk findings and a remediation plan.	Enkrypt AI says the scanner discovers tools, analyzes capabilities and permissions, checks for direct and indirect prompt injection and flags over-privilege.	A commercial relationship; the pages read publish no scanner price.
Akto MCP Security	Finding MCP servers in a company's networks and red-teaming them for prompt injection and tool poisoning.	Akto says its module discovers MCP servers and their agentic components, runs targeted red teaming and monitors them. Its recon scans only the IP ranges an admin enters.	Akto Argus, its platform; the pages read publish no price.

To see whether agents can find, read and use the server: Ora, then fix what it names.
To debug a single call or script a smoke test: MCP Inspector.
To look for prompt injection, tool poisoning and over-privilege: Snyk Agent Scan or Cisco MCP Scanner when open source and a local run matter, Enkrypt AI or Akto when a commercial product and a report matter.

Run the check

Put the server at a public URL. For a local server, Ora's CLI audits localhost through a tunnel you start with --tunnel-cmd.
Scan the server URL with Ora, from the web page, from POST /api/scan or with the scan_domain tool.
Poll GET /api/score/{domain} until analysisStatus is complete; deep checks finish after the first answer.
Fix the failing checks in order of points, then re-run only those ids with POST /api/scan/checks.
Gate releases with npx ax@0.10 audit <url> --min-score <n>, which exits non-zero below the threshold.

curl -s -X POST https://ora.ai/api/scan -H 'content-type: application/json' -d '{"url":"https://your-server.example/mcp"}'

The call above is the documented request, shown for reference; this directory has never sent it.

What the directory shows

Ora has a cached score for 933 of the 1,336 companies in this directory, read on 5 November 2026. Of the 263 companies with an open MCP server, 94 have a cached score, with a median of 68. The scores by category and what moves them.