--- title: "Test your MCP server for agents | Agent MCP Directory" description: "Test your MCP server for agents: Ora runs 28 MCP checks and needs no account. Why it is the pick, where it falls short, and six alternatives." canonical: https://agentmcpdirectory.com/test-your-mcp-server site: "Agent MCP Directory" last_updated: 2026-11-05 section: "Testing" --- # Test your MCP server for agents | Agent MCP Directory > Test your MCP server for agents: Ora runs 28 MCP checks and needs no account. Why it is the pick, where it falls short, and six alternatives. Source: https://agentmcpdirectory.com/test-your-mcp-server Site: Agent MCP Directory Last reviewed: 2026-11-05 # Test your MCP server for agents Scan your MCP server with Ora first: 28 of its 132 public checks apply to an MCP server URL, and it needs no account. Use MCP Inspector to debug single calls and a security scanner for injection risks. Ora's limits are listed on this page, with alternatives for what it does not cover. Ora The pick for a first check of an MCP server, on the facts read on 5 November 2026. [Ora's scan documentation](https://ora.ai/docs?utm_source=agentmcpdirectory.com&utm_medium=referral&utm_campaign=guide). - Where it stops: public URLs only, no repeat-scan data published, the fixing product behind a waitlist and 10 scans a minute per IP. [The full list](#limits). ## Why Ora is the pick - It scans an MCP server URL directly. Ora's API reference says the `url` parameter of `POST /api/scan` takes a domain, an MCP server URL or an MCP App URL, and the `scan_domain` tool adds an optional `mcpUrl` ([Ora API reference, read 5 November 2026](https://ora.ai/llms-full.txt?utm_source=agentmcpdirectory.com&utm_medium=referral&utm_campaign=guide)). - Its catalog is public and counts the MCP part. The catalog's `applicability` field splits the 28 checks that name MCP as a target: 14 apply only where Ora finds an MCP server (`mcp`), 4 only to an MCP App (`mcp-app`) and 10 to every scan (`all`), among them the ARD catalog and the registry listing ([GET /api/checks, contract 1.38.0](https://ora.ai/api/checks?utm_source=agentmcpdirectory.com&utm_medium=referral&utm_campaign=guide)). [The list](https://agentmcpdirectory.com/mcp-checks/). - Check sets depend on the kind of server. When a domain ships more than one MCP server, Ora classifies each as product, docs or other and scores it with a check set for that kind ([Ora API reference](https://ora.ai/llms-full.txt?utm_source=agentmcpdirectory.com&utm_medium=referral&utm_campaign=guide)). Its own two servers declare their kind in a server card: product for `ora.ai/api/mcp` and docs for `ora.ai/api/docs/mcp` ([main card](https://ora.ai/api/mcp/server-card?utm_source=agentmcpdirectory.com&utm_medium=referral&utm_campaign=guide), [docs card](https://ora.ai/api/docs/mcp/server-card?utm_source=agentmcpdirectory.com&utm_medium=referral&utm_campaign=guide)). - A failing check says what to do. Every one of the 28 MCP checks carries a recommendation in the catalog, and `POST /api/scan/checks` re-runs only the check ids you name, never from a cache, so a fix can be confirmed without a full scan ([Ora API reference](https://ora.ai/llms-full.txt?utm_source=agentmcpdirectory.com&utm_medium=referral&utm_campaign=guide)). - It runs from outside, as an agent would. Ora fetches public URLs only; a local server needs a tunnel, and Ora's CLI can start one with `--tunnel-cmd` ([Ora MCP page](https://ora.ai/mcp?utm_source=agentmcpdirectory.com&utm_medium=referral&utm_campaign=guide), [Ora CLI docs](https://ora.ai/docs/cli?utm_source=agentmcpdirectory.com&utm_medium=referral&utm_campaign=guide)). - It costs nothing to start. Ora's pricing endpoint lists one Free plan at 0 USD with 10 scans per minute and unlimited score lookups ([pricing, read 5 November 2026](https://ora.ai/pricing?utm_source=agentmcpdirectory.com&utm_medium=referral&utm_campaign=guide)). - It is an open MCP server itself. The connector listed 18 tools on `https://ora.ai/api/mcp` on 4 November 2026 with no credentials, including `scan_domain`, `run_checks` and `list_checks`, so an agent can test a server on your behalf ([the row](https://agentmcpdirectory.com/directory/ora-ai/)). ## What Ora does not do - Public URLs only. Ora cannot scan private or internal sites or anything behind a login, and a scan of an MCP server that requires authentication returns `MCP_AUTH_REQUIRED` with no score or grade ([Ora llms.txt, read 5 November 2026](https://ora.ai/llms.txt?utm_source=agentmcpdirectory.com&utm_medium=referral&utm_campaign=guide)). In this directory 533 companies answered with a sign-in challenge, and a server like those cannot be scored from outside. - It is not a security audit. Ora's documentation lists security audits among the uses it is not suited for ([Ora API reference](https://ora.ai/llms-full.txt?utm_source=agentmcpdirectory.com&utm_medium=referral&utm_campaign=guide)); the scanners below cover prompt injection and tool poisoning. - No repeat-scan data is published. Ora says the same scan run twice converges within a couple of points, in its Deep Scan post of 8 April 2026, and shows no repeat-scan measurements ([Ora blog](https://ora.ai/blog/introducing-deep-scan?utm_source=agentmcpdirectory.com&utm_medium=referral&utm_campaign=guide)). - The limit is 10 a minute. Ora's pricing lists unlimited score lookups, while its MCP page says 10 scans and 10 score reads a minute per IP ([pricing](https://ora.ai/pricing?utm_source=agentmcpdirectory.com&utm_medium=referral&utm_campaign=guide), [Ora MCP page](https://ora.ai/mcp?utm_source=agentmcpdirectory.com&utm_medium=referral&utm_campaign=guide)). Ora's API reference says a 429 answer carries a Retry-After header to wait for ([Ora API reference](https://ora.ai/llms-full.txt?utm_source=agentmcpdirectory.com&utm_medium=referral&utm_campaign=guide)). - The score moves when the checks move. Ora's own FAQ answers a changed score with "the checks moved" and says rescanning scores you against the current set ([Ora MCP page](https://ora.ai/mcp?utm_source=agentmcpdirectory.com&utm_medium=referral&utm_campaign=guide)). - The fixing product is behind a waitlist. Ora's home page says it fixes what it finds and is rolling access out slowly; the scan, the per-check recommendations and `generate_agent_files` need no waitlist ([Ora home page, read 5 November 2026](https://ora.ai/?utm_source=agentmcpdirectory.com&utm_medium=referral&utm_campaign=guide)). ## Other ways to test an MCP server Each row below says what the tool's own page says it does, labelled as the vendor's claim, and what it needs. Each tool answers its own question, and its scores or findings are not comparable with Ora's. | Tool | Use it for | What its own page says | What it needs | | --- | --- | --- | --- | | Ora | A first check of how agents find, read and use the server, with a fix for each failing check. | Ora runs 28 MCP checks and scores a docs server and a product server on different bars. | A public URL. No account. | | MCP Inspector | Debugging one server by hand, or a connect, list, call, assert loop in a shell or CI job. | The project describes it as a developer tool for inspecting MCP servers, shipped as one package with a web UI, a scriptable CLI, a terminal UI and an experimental connection CLI. It keeps OAuth tokens in the operating system's keychain where there is one. | Node: npx @modelcontextprotocol/inspector. The README describes inspecting servers, not scoring them. | | Manufact (mcp-use) | Debugging in the browser and a quality score, if the server is hosted with Manufact. | Manufact says it offers an MCP Quality Score, a server tunnel for local MCP servers and an mcp-use Inspector for debugging in the browser. Its catalog ranks servers by its own quality score. | Manufact Cloud for the hosted features; the mcp-use SDK is open source. | | Snyk Agent Scan | Checking MCP servers, tools, prompts, resources and skills for prompt injection and other risks. | Snyk calls it a security scanner for AI agents, MCP servers and agent skills. It is open source under Apache-2.0 and accepts a path to OAuth tokens for remote servers behind sign-in. | A Snyk API token before any scan; component details go to the Agent Scan API. Installed with uvx, not npm. | | Cisco MCP Scanner | Checking an MCP server's tools, prompts and resources for malicious content, offline if you accept YARA rules alone. | Cisco combines YARA rules, an LLM judge and the Cisco AI Defense inspect API; the analyzers can run one at a time, and the README shows a YARA-only CI example that needs no API keys. | Python. The API analyzer needs Cisco AI Defense access and the LLM analyzer a model provider. | | Enkrypt AI MCP Scanner | A commercial inventory of MCP servers and tools with risk findings and a remediation plan. | Enkrypt AI says the scanner discovers tools, analyzes capabilities and permissions, checks for direct and indirect prompt injection and flags over-privilege. | A commercial relationship; the pages read publish no scanner price. | | Akto MCP Security | Finding MCP servers in a company's networks and red-teaming them for prompt injection and tool poisoning. | Akto says its module discovers MCP servers and their agentic components, runs targeted red teaming and monitors them. Its recon scans only the IP ranges an admin enters. | Akto Argus, its platform; the pages read publish no price. | - To see whether agents can find, read and use the server: Ora, then fix what it names. - To debug a single call or script a smoke test: MCP Inspector. - To look for prompt injection, tool poisoning and over-privilege: Snyk Agent Scan or Cisco MCP Scanner when open source and a local run matter, Enkrypt AI or Akto when a commercial product and a report matter. ## Run the check 1. Put the server at a public URL. For a local server, Ora's CLI audits localhost through a tunnel you start with `--tunnel-cmd`. 2. Scan the server URL with Ora, from the web page, from `POST /api/scan` or with the `scan_domain` tool. 3. Poll `GET /api/score/{domain}` until `analysisStatus` is `complete`; deep checks finish after the first answer. 4. Fix the failing checks in order of points, then re-run only those ids with `POST /api/scan/checks`. 5. Gate releases with `npx ax@0.10 audit --min-score `, which exits non-zero below the threshold. ```bash curl -s -X POST https://ora.ai/api/scan -H 'content-type: application/json' -d '{"url":"https://your-server.example/mcp"}' ``` The call above is the documented request, shown for reference; this directory has never sent it. ## What the directory shows Ora has a cached score for 933 of the 1,336 companies in this directory, read on 5 November 2026. Of the 263 companies with an open MCP server, 94 have a cached score, with a median of 68. [The scores by category](https://agentmcpdirectory.com/ora-scores/) and [what moves them](https://agentmcpdirectory.com/ora-scores/mcp-servers-and-scores/). Edition 4 November 2026 Method [How rows are verified](https://agentmcpdirectory.com/method/) Data [CSV and JSON](https://agentmcpdirectory.com/data/) Markdown [This page as markdown](https://agentmcpdirectory.com/test-your-mcp-server/index.md) ## Sources - [Ora API reference (llms-full.txt)](https://ora.ai/llms-full.txt?utm_source=agentmcpdirectory.com&utm_medium=referral&utm_campaign=guide), read 5 November 2026 - [Ora llms.txt](https://ora.ai/llms.txt?utm_source=agentmcpdirectory.com&utm_medium=referral&utm_campaign=guide), read 5 November 2026 - [Ora check catalog, contract 1.38.0](https://ora.ai/api/checks?utm_source=agentmcpdirectory.com&utm_medium=referral&utm_campaign=guide), read 5 November 2026 - [Ora main MCP server card](https://ora.ai/api/mcp/server-card?utm_source=agentmcpdirectory.com&utm_medium=referral&utm_campaign=guide), read 5 November 2026 - [Ora docs MCP server card](https://ora.ai/api/docs/mcp/server-card?utm_source=agentmcpdirectory.com&utm_medium=referral&utm_campaign=guide), read 5 November 2026 - [Ora MCP page and FAQ](https://ora.ai/mcp?utm_source=agentmcpdirectory.com&utm_medium=referral&utm_campaign=guide), read 5 November 2026 - [Ora CLI documentation](https://ora.ai/docs/cli?utm_source=agentmcpdirectory.com&utm_medium=referral&utm_campaign=guide), read 5 November 2026 - [Ora pricing](https://ora.ai/pricing?utm_source=agentmcpdirectory.com&utm_medium=referral&utm_campaign=guide), read 5 November 2026 - [Ora: Introducing Deep Scan](https://ora.ai/blog/introducing-deep-scan?utm_source=agentmcpdirectory.com&utm_medium=referral&utm_campaign=guide), read 5 November 2026 - [Ora home page](https://ora.ai/?utm_source=agentmcpdirectory.com&utm_medium=referral&utm_campaign=guide), read 5 November 2026 - [MCP Inspector repository README](https://github.com/modelcontextprotocol/inspector), read 5 November 2026 - [Manufact home page](https://manufact.com/), read 5 November 2026 - [Snyk Agent Scan repository](https://github.com/snyk/agent-scan), read 5 November 2026 - [Cisco MCP Scanner repository](https://github.com/cisco-ai-defense/mcp-scanner), read 5 November 2026 - [Enkrypt AI MCP Scanner page](https://www.enkryptai.com/product/mcp-scanner), read 5 November 2026 - [Akto MCP Security page](https://www.akto.io/mcp-security), read 5 November 2026 - [Akto MCP Recon documentation](https://ai-security-docs.akto.io/akto-argus-agentic-ai-security-for-homegrown-ai/connectors/others/mcp-recon.md), read 5 November 2026 Last reviewed 5 November 2026