QAmcp is a free, open-source command-line tool that connects to your MCP server the way an AI app would, runs a set of fixed checks and gives it a score out of 100. It was posted to Hacker News as a Show HN on 21 October 2026. Its pitch is simple: hard pass/fail facts about your server, with no AI model doing the grading.
Key takeaways
- QAmcp tests Model Context Protocol (MCP) servers over the network or as local programs, and needs Node.js 20 or newer.
- It scores 13 kinds of checks, from “connects” to “no secrets leaked”, and caps the score hard when it finds serious problems such as hidden instructions.
- By default it only runs tools the server labels read-only, and it sends no data anywhere except the server under test.
- A GitHub Action can post the score on pull requests and fail a build below a score you choose.
- The project is brand new (v0.1.5 on its website, 2 GitHub stars when we checked), so treat it as a promising early tool, not a standard.
What is QAmcp, and why would you test an MCP server?
MCP is an open protocol that lets AI apps such as chat assistants and coding agents call outside “tools”: search a database, fetch a document, file a ticket. An MCP server is the program that offers those tools. It publishes a list of them, each with a name, a plain-text description and an input schema (a JSON description of the arguments it accepts).
The catch is that the AI model reads those descriptions and trusts them. A vague description means the model calls the wrong tool. A tool that hangs leaves your agent stuck. An error message that echoes an API key leaks it straight into a chat log. None of that shows up when you only test the server by hand with one happy-path call.
Think of QAmcp as a roadworthiness test for your server. It doesn’t tell you whether the car is fun to drive. It tells you whether the brakes, lights and seatbelts work before anyone gets in.
How do you run it?
You don’t have to install anything permanently. According to the project README, one command tests a remote server:
npx qamcp-cli https://your-server.com/mcptests a server over HTTP.npx qamcp-cli --stdio "npx -y @your-org/your-server"tests a local program that talks over stdio (standard input and output).npx qamcp-cli --demoruns against a built-in server with planted bugs, takes about 30 seconds and writes an HTML report.--headerpasses an API key, and--loginopens a browser for servers behind OAuth.
Reports come out as HTML, JSON or JUnit, the XML format most CI systems already understand. Exit codes are scriptable: 0 means pass, 1 means a required check failed, 2 means bad options and 3 means the server couldn’t be tested at all.
How the QAmcp score works
Each check carries a weight. Connecting and having every tool described are worth 15 points each. Most others, including bad-input handling and safety labels, are worth 10. Speed and secret-leak checks are worth 5. Checks that don’t apply, like OAuth on a server with no login, are left out of the score rather than counted as failures.
The clever part is the ceilings. Some problems are so serious that a perfect score elsewhere shouldn’t hide them:
| Problem found | Maximum possible score |
|---|---|
| Hidden instructions in a tool | 40 |
| Leaked secret | 50 |
| Broken tool definition | 50 |
| Tool that crashes, hangs or returns empty “success” | 70 |
The README’s rough guide: 90 and above is solid, 70 to 89 needs fixes, and below 70 suggests trouble for AI apps. On the project website, the deliberately broken demo server scores 38/100. Context7, a public documentation server from Upstash, scored 100/100 in a test dated 15 October 2026. QAmcp says it has no ties to Upstash.
Why the hidden-instruction check matters most
That 40-point ceiling exists for a reason. On 1 April 2025, Invariant Labs described “tool poisoning”, an attack where a tool’s description carries instructions the model sees but the user doesn’t. Their example was an innocent-looking add tool whose description quietly told the model to read SSH keys and config files and slip them into an extra argument.
The MCP specification itself warns that clients must treat tool annotations as untrusted unless they come from trusted servers. So a check that flags suspicious text in descriptions is useful whether you build servers or just install them.
Is it safe to point QAmcp at a production server?
The tool is cautious by design. It only calls tools the server marks as read-only, and it never runs tools whose names suggest destruction, such as delete_account. A --look-only flag skips tool calls entirely. The project says it sends nothing to AI services, trackers or telemetry, and login details stay on your machine.
One caveat worth thinking about: “read-only” is a label the server sets for itself. A buggy server could mislabel a tool that writes data. Our view: run it against staging first, and use --look-only on anything you can’t afford to touch.
QAmcp vs MCP Inspector: which do you need?
The official MCP Inspector is the obvious comparison. They do different jobs.
| QAmcp | MCP Inspector | |
|---|---|---|
| Main job | Automated quality score | Interactive debugging |
| Interfaces | CLI, GitHub Action, Node API | Web app, CLI, terminal UI |
| Verdict | Pass/fail with a score out of 100 | You inspect results yourself |
| Security checks | Hidden instructions, secret leaks | Not its focus |
| Maturity | Early, v0.1.x | Official project from the MCP team |
In practice: use the Inspector while building a tool, and something like QAmcp in CI to stop regressions. If you’re working through a wider release checklist, our guide to AI agent evaluation before you ship covers the agent side of the same problem.
What happens next
The project is tiny for now. When we checked the repo it had 39 commits, 2 stars and no individual author named, only a QAmcp GitHub organisation. That’s normal for a fresh Show HN, but it means you should read the code before you trust it with credentials.
Watch for three things: whether the --baseline regression feature holds up on large servers, whether the hidden-instruction check produces false alarms on long, legitimate descriptions, and whether MCP server authors start showing QAmcp scores in their READMEs. If they do, it could turn into a quick trust signal, as our look at production-grade AI agents argues teams need.
FAQ
Is QAmcp free?
Yes. It is open source under the MIT licence and needs no account. No paid tier is mentioned.
Does QAmcp use AI to judge my server?
No. Every check is a pass/fail, a timing in milliseconds or an exact match, and the project says no data goes to AI services.
Can QAmcp test local MCP servers?
Yes. The --stdio flag launches a local program and tests it. QAmcp also starts it a second time briefly to confirm it prints only MCP messages.
Got an MCP server? Run npx qamcp-cli --demo to see a broken report first, then point it at your own staging server and see where your score lands.
2 comments