Join the waitlist→

///// Checks

132 checks, four questions

Every check Backwatch can run against your site and MCP server. 64 run in the free CLI today; the rest need a deep scan with an MCP session, a browser or search.

Catalogue 1.38.0132 checks
  • Readability38
  • Discoverability28
  • Connectability44
  • Presence6
  • Reported, not scored16

Free CLI 64 Deep scan 6812 core, always counted

///// Why these checks

Checks you can verify, not a score you take on trust

Open source, MIT

The CLI and the checks it runs are MIT licensed. Read how a verdict is reached, or run it yourself.

Evidence on every verdict

Each result shows what was requested and what came back, so a failure is something you can reproduce.

Unresolved is never a failure

A check that couldn't be resolved is shown as unresolved and left out of the score.

No AI decides a score

Scoring is deterministic. AI may help explain a finding; it never sets a verdict.

Sign-in checked from outside

The chain every host follows, from the side your users are on. With --register, on your own server, each host's real callback.

Grounded in a 1,000-server study

The sign-in checks were run across a random 1,000 servers from the official MCP Registry.

///// Four pillars

What agents need from you

01 Readability

Can agents read you?

llms.txt and its size budget, Markdown negotiation, Markdown for real pages rather than a false 404, and content that loads without JavaScript.

02 Discoverability

Can agents find your server?

/.well-known MCP discovery and server cards, API catalogues, and whether your proxy blocks dot-paths.

03 Connectability

Can agents sign in and call tools?

The MCP sign-in chain every host follows: the 401 challenge, protected-resource and authorization-server metadata, PKCE and client registration. With --register, on your own server, it proves each host's callback can register.

04 Presence

Are you listed where agents look?

Whether your MCP server is listed in the official MCP Registry, where hosts and directories look for it.

The sign-in chain every host follows
AI host
/mcpyour server
  1. 401 challengeWWW-Authenticate: resource_metadata
  2. Protected-resource metadata/.well-known/oauth-protected-resource
  3. Authorization-server metadata/.well-known/oauth-authorization-server
  4. PKCEcode_challenge_methods_supported: S256
  5. Client registrationregistration_endpoint

The host stops here, and nothing looks wrong on your side.

///// All checks

Every check

Pre-release: every check is still being calibrated against fixtures and real sites. Checks marked always counted score even where they would otherwise be a bonus, because when they break, agents fail.

132 of 132 checks

Catalogue 1.38.0

///// Scoring

A verdict per pillar, a score only with evidence

The overall score uses only pillars with a verdict. A check that doesn't apply to your site is left out, not failed.

PASS90 or more
WARN60 to 89
FAILBelow 60
UNKNOWNFewer than half the checks that apply could be resolved; no score is shown