MCPComp Documentation

Run the scanner

Once published to npm:

npx mcpcomp https://mcp.linear.app/mcp

From the repository:

corepack enable
pnpm install
pnpm run build

node clients/cli/dist/scan.mjs https://mcp.linear.app/mcp
node clients/cli/dist/scan.mjs https://mcp.linear.app/mcp --json

Read the result

Four outcomes, because “graded F” is the wrong answer to three of them:

$ mcpcomp https://mcp.linear.app/mcp
Grade: A  (0 requirement violations; advisories do not affect the grade)
Checks: 36 ran, 0 violated, 3 not run
Advisories (1) — recommendations not followed:
  [medium] Authorization-response issuer binding is not advertised
    fix: Enable RFC 9207 and advertise authorization_response_iss_parameter_supported: true.
    spec: https://www.rfc-editor.org/rfc/rfc9207.html#section-2

$ mcpcomp https://mcp.deepwiki.com/mcp
The server served the probed MCP operation without authorization.
Authorization is optional in MCP, so there is nothing to audit here. A server
can still require authorization for operations that were not probed.

$ mcpcomp https://sh.inference.ac
The endpoint redirects (HTTP 301) to https://api.inference.sh/mcp.
Scan that URL instead.

$ mcpcomp https://mcp.sentry.dev
The endpoint answered but never demanded authorization and did not serve the
probed MCP operation, so there is no authorization surface at this URL to
audit. Authorization-server metadata was found at this origin, so the MCP
endpoint likely lives on another path of this host — scan that URL instead.

Every finding carries a fix: line naming the change that clears it, and a spec: line citing the requirement it enforces.

Exit codes

For CI, --junit report.xml writes the same verdict as JUnit XML (one test case per check) alongside the exit code.

Code	Meaning
`0`	Pass, or nothing to audit
`1`	Grade D
`2`	Grade F, or a bad argument
`3`	Inconclusive — a redirect, an unreachable endpoint, or a URL with no authorization surface to audit is not a pass

Automation should treat 3 as “look at this”, not as healthy. A monitor that reads an unreachable endpoint as 0 goes quiet on the day it matters.

Next steps

What gets checked

The full check catalogue and what each one cites.

Watch for drift

Save a baseline and get alerted when the configuration moves.

Diagnose a failure

Name the failing layer — and the exact known client bug — with mcpcomp doctor.

​Run the scanner

​Read the result

​Exit codes

​Next steps

What gets checked

Watch for drift

Diagnose a failure

Run the scanner

Read the result

Exit codes

Next steps