What is the Model Context Protocol (MCP)?

MCP is an open standard by Anthropic that defines how AI models interact with external tools, resources, and prompts via JSON-RPC 2.0. Any MCP-compatible client like Claude Desktop or VS Code can discover and invoke tools exposed by MCP servers.

Is my data sent to any server?

No. The Tester and Scanner connect directly from your browser to the endpoint you specify. Nothing is proxied through our servers. You can verify this in the DevTools Network tab.

What does the Security Scanner check?

It runs 27 checks across 7 categories: Transport (HTTPS, HSTS, redirects), Protocol (handshake, version negotiation, unknown methods), Authentication (unauthenticated access, OAuth metadata, token rejection), Information Disclosure (headers, error verbosity, tool risk analysis), Injection (path traversal, code injection, prompt injection, data exfiltration), CORS (wildcard origin, credentials, origin reflection, security headers), and Resilience (rate limiting, timeout handling).

How is the security score calculated?

Starting from 100, each failed check deducts points by severity: critical=25, high=15, medium=10, low=5, info=0. Warnings deduct 25% of the fail penalty. Each category is capped at 30 points maximum deduction. Final grade: A (90+), B (75+), C (55+), D (35+), F (below 35).

Why am I getting a CORS error?

The MCP server lacks Access-Control-Allow-Origin headers. The server needs to set allow-origin, allow-headers (Mcp-Session-Id, Content-Type), and allow-methods (POST, OPTIONS). As a workaround, use Copy as cURL since terminals have no CORS restrictions.

AI & LLM

MCP Playground

Free online MCP (Model Context Protocol) playground and security scanner. Connect to any MCP server via Streamable HTTP, send JSON-RPC requests, invoke tools with auto-generated schema forms, and run 27 automated security checks across 7 categories with an A-F grade. 100% client-side.

Open tool

Quick reference

Category: AI & LLM
Runs in: Browser
Data stored: Nothing
Price: Free
Sign-up: Not needed

Browse categories

All features

Connect to any MCP server via Streamable HTTP transport
Auto-generated schema forms for tool invocation
Browse tools, resources, and prompts with search
Auth: Basic, Bearer, and OAuth 2.0 (3 grant types)
27 automated security checks across 7 categories
A-F security grade with severity-weighted scoring
Request/response inspection with Events log
Copy as cURL for terminal debugging

What you can do

Test MCP endpoints

Send JSON-RPC 2.0 requests — initialize, tools/list, tools/call — to any MCP server via Streamable HTTP transport.

Browse available tools

Discover the tools and resources exposed by an MCP server and invoke them with custom parameters.

Run security scans

Execute 27 automated security checks across transport, protocol, authentication, disclosure, injection, CORS, and resilience categories.

Grade MCP server security

Get an A-F security grade with severity-weighted findings for each check, capped per category to avoid skewing.

Debug JSON-RPC responses

See raw request and response payloads, session IDs, and SSE streams for troubleshooting MCP server compatibility.

Private by design

Client-side
No sign-up
Free

MCP Playground runs entirely in your browser tab. No data is uploaded, no server processes your input, and no account is required.

Specifications

Protocol: MCP (Model Context Protocol) via JSON-RPC 2.0
Transport: Streamable HTTP (protocol version 2025-11-25)
Tester methods: initialize, tools/list, tools/call, resources/read, prompts/get, ping, raw
Auth modes: None, Basic, Bearer, OAuth 2.0 (client credentials, auth code, password)
Security checks: 27 across 7 categories (transport, protocol, auth, disclosure, injection, CORS, resilience)
Grade scale: A (90+), B (75+), C (55+), D (35+), F (<35), severity-weighted
Processing: Direct browser-to-endpoint, no proxy