MCP Config & JSON-RPC Transcript Inspector

Paste an MCP server configuration or a captured JSON-RPC session. The review reads only the text you supply: it recognizes stdio and Streamable HTTP shapes, checks the stable 2025-11-25 initialization order, matches request and response IDs, inspects tools/list schemas and tools/call arguments, and flags plaintext credentials. No process is started and no server is contacted.

Runs locally in your browserStable baseline: MCP 2025-11-25

View category: AI & LLM (7)

MCP input

Inspect configuration and protocol shape without connecting

The checker follows the stable 2025-11-25 lifecycle and tool fields. It recognizes stdio and Streamable HTTP configuration patterns, but does not prove interoperability, trust a tool description, or implement draft release-candidate behavior.

How to review an MCP server config or a captured JSON-RPC session

The page has two modes. Server config mode reads an mcpServers object — or a single server — and reports the transport, the argument, environment and header shapes, the URL scheme and any value that looks like a plaintext credential. JSON-RPC transcript mode reads a captured session as a JSON array or one message per line.

Both modes are static: the text is inspected, never executed. The rules follow the stable 2025-11-25 specification, so a session that passes this check has the expected message order and field shapes — that is not proof that a server and client interoperate, and draft release-candidate behaviour is intentionally out of scope.

Paste the configuration, or the captured session, into the input — or press Load example to fill the current mode with a working sample.

Press Inspect input. In config mode the pipeline lists each server with its detected transport; in transcript mode it lists each message in order.

Read the metrics: servers, or requests and responses, notifications, tool definitions and unmatched IDs, together with the error and warning counts.

Work through the findings list. Each entry has a severity, a code, a JSON path such as $.mcpServers.docsApi.url and a sentence that names the field to fix.

Fix the input and run again, or press Clear. An empty or unparsable input clears the previous result instead of leaving it on screen.

What the inspector checks, and what it cannot prove

What server config mode checks

Transport: exactly one of command (stdio) or url (Streamable HTTP) per server. A URL must be an absolute http or https address; a remote plain-http URL is flagged as a warning, and a command that contains shell metacharacters is flagged because the value may reach a shell.

Fields and secrets: args must be an array, env and headers must be objects, and a name under env or headers that matches token, secret, password, api_key, authorization or credential with a non-empty value is flagged as a plaintext credential. A server name may only contain letters, digits, dot, underscore and hyphen.

What transcript mode checks

Lifecycle: every message must be a JSON object with jsonrpc "2.0"; an initialize request needs protocolVersion, capabilities and clientInfo, an initialize response needs protocolVersion, capabilities and serverInfo, and notifications/initialized must not appear before a successful initialize response. tools/list or tools/call traffic before that point is reported as a warning.

Messages and tools: a request or notification needs a string method; a response needs an id, and an id that no request matches — or a request that no response captures — is reported. tools/call needs params.name and an object params.arguments; tools/list needs a tools array, and every tool needs a valid, unique name and an object inputSchema.

What the page does not do

It does not start a process, open a connection, follow a URL or send a credential: the pasted text stays in the browser and is never uploaded. It also does not verify that a tool description is trustworthy.

It cannot prove runtime interoperability, and it does not implement behaviour from draft release candidates. Treat a clean report as one checked input among the tests you run against a real MCP client and server.