What Does Inspecting an MCP Server Involve?

📘 What the step consists of

Inspecting an MCP server means connecting to it by hand and exercising what it publishes before an agent is pointed at it: complete the handshake, list the operations, resources and prompts it advertises, call each operation with representative arguments, and read what comes back — including what comes back when the arguments are deliberately wrong.

The step exists because of an asymmetry that is easy to miss. A caller has nothing to go on except what the server says about itself: an operation’s name, its description, and the schema of its arguments. When that description is inaccurate, nothing errors. The call is made, it succeeds, and the result is wrong in a way that looks like a reasoning failure somewhere else entirely.

Two kinds of failure are worth separating while inspecting, because they are reported differently. A protocol-level error means the request itself was malformed or unsupported. A failure inside an operation is normally returned as an ordinary result carrying an error message, because the caller is expected to read it and react. A surface that returns the second where a caller expects the first is a surface that will be misread.

What is worth varying is narrower than a test plan and quite specific: the argument that is absent, the one of the wrong type, the one far outside any sensible range, and the one that is unusually large. Then read each answer as a caller would rather than as its author does — a result that is technically correct and unreadable is a result something will misuse, and a refusal that does not name the offending argument produces the same call again. The last thing to look at is the one no schema expresses: whether the operation touches anything its description never mentions.

🧩 When the reading has to be done again

Whenever the surface can have moved. A server version changes; a notification says the published list is no longer what it was; an operation is added by somebody who did not write the description of the one beside it.

And whenever the deployment moves, which is the less obvious half. The same implementation reached at a different address, under a different account, from a different position on a network, is the same operations against a different environment: the paths it can see and the systems it can reach have changed underneath identical descriptions, and a handful of the same calls will say so immediately.

📐 Inspection is not a test suite

There is no assertion here, no fixture and no pass mark. Inspection is a reading exercise, and its output is a list of places where the published description implied something the behaviour did not.

⚙️ How the Registry classifies inspecting a server surface

Exercising a surface by hand and recording what each call returns is examination of an existing system rather than a change to it, which is what the data processing class covers. On the order form's task class field, select Data processing, which covers data handling, transformation, analysis, and computation. That class has its own page at /tasks/analysis.

The Registry files this topic under one canonical task, fixed in advance and published here rather than generated per visit:

Exercise every operation exposed by an MCP server by hand and record which calls return an error before an agent is connected.

That string, hashed once, is 08e813bb9a07b423… — the first sixteen of sixty-four hex characters. An assessment ordered against a task of this kind is computed from the class, the wording submitted, and the permanent chart the Registry derives for the model configuration named on the order: its ascendant, its ruling planet, and the composite harmony that constrains the range of verdicts available to it. The whole derivation is published at /method.

The risk in inspection is the false clear: a surface that answered correctly for the one argument shape somebody tried by hand, and differently for the shapes an agent will actually produce. 4 risk factors are tracked for data processing tasks generally; an assessment reports 3 of them, selected by the submitted task's own seed rather than chosen. Their names, severities and descriptions are certificate content and are not published on a free page.

Get Assessment

📏 What this page does not claim

The Registry makes no representation that an assessment predicts the outcome of any task, and no assessment is validated against real-world results.

This page defines a term and states a classification. It publishes no verdict: the Registry does not test implementations, does not measure how often anything works, and has never run the canonical task above against any model. Which operations are exercised, with what arguments, and what counts as an acceptable answer are judgements a real inspection makes and the canonical brief does not.

What is sold is a permanent, numbered assessment for one submitted task at one model configuration — a verdict on a seven-point scale, a recommended execution window, and, above the first tier, the risk factors the class tracks. EUR 1.90 Standard, EUR 4.90 Extended, and EUR 14.90 Full Chart, which adds the permanent chart for the configuration itself. Assessments from EUR 1.90; machine-readable at /pricing.json.

🔗 Related surfaces

← All MCP topics · The AFR-1 method · Data processing task class

Related topics: Tools · Listing and discovery · Security considerations

❓ Questions about inspection

Why inspect an MCP server before connecting an agent to it?

Because the only thing a caller has to go on is what the server says about itself. An inaccurate description does not produce an error; it produces a call that succeeds and a result that is wrong, and the wrongness surfaces far from its cause.

What is actually checked during inspection?

That the handshake completes; that the advertised list matches what exists; that each operation accepts the arguments its schema describes and rejects the ones it should reject; and that failures are reported in the form a caller expects.

Is inspection a one-off step?

No. What a server publishes changes between versions, and a list-changed notification tells a connected client only that something moved — not whether a description still matches the behaviour behind it.

What should be varied while inspecting an operation?

The absent argument, the wrong type, a value well outside the range the operation expects, and something unusually large. What matters is not only whether the call is refused, but whether the refusal names the problem — a failure a caller cannot act on produces the same call again.