Online MCP Inspector (read-only)
This is a read-only MCP inspector that runs in your browser. Paste a public https endpoint. The page sends two JSON-RPC requests and prints the response. It is not the official MCP Inspector desktop app, and it is not a proxy. The requests leave your browser and go to the URL you typed.
The tester runs in your browser. We do not receive or store the URL or any responses.
Many servers block browser (CORS) requests or require sign-in; those will show as errors here. A server-side checker is planned.
What it sends
The first request is initialize. The MCP lifecycle specification (2025-06-18) says initialization is the first interaction between a client and a server. The client sends a protocol version, client capabilities, and client implementation info. This tester sends protocol version 2025-06-18, an empty capabilities object, and clientInfo with name mcpwell-tester and version 0.1. The JSON-RPC id is 1.
The HTTP headers on that POST are Content-Type: application/json and Accept: application/json, text/event-stream. Those two Accept values are what the Streamable HTTP transport requires when a client POSTs a JSON-RPC message. credentials is omit, so the browser does not attach cookies. cache is no-store. The abort timeout is 10 seconds.
If the response body is server-sent events, the tester takes the first line that starts with data: and parses that line as JSON. Otherwise it parses the whole body as JSON. It prints the HTTP status. When the JSON has a result, the printout keeps only protocolVersion, serverInfo, and capabilities. When the JSON is an error object, it prints that error. Raw text, if JSON parsing fails, is cut at 500 characters.
A second request is sent only when initialize returned a result. That request is tools/list, JSON-RPC id 2, with empty params. If the initialize response included an Mcp-Session-Id header, the tester sends that value back on the second request. The transport spec says that when a server assigns a session id on the initialize response, the client must send it on later HTTP requests. The tester does that and does not invent a session id.
tools/list output is the HTTP status, the number of tools in result.tools, and one line per tool with the tool name. If a tool has annotations.readOnlyHint, the line adds "(read-only hint)". The tester does not print tool input schemas.
What it refuses to send
The script's allow-list is exactly initialize and tools/list. Any other method throws before fetch. That blocks tools/call, resources/read, prompts/get, and anything else. There is no field for an API key, bearer token, or header you supply. A 401 response adds the sentence: "This server requires sign-in; the tester does not accept credentials."
The form checks the URL before the network call. The protocol must be https:. Hostnames starting with localhost, 127., 10., 192.168., or 172.16. through 172.31. are rejected with "Enter a public https:// URL." A private or local server is not contacted.
Submits are limited to one test every 15 seconds, measured in the page with Date.now. A faster submit prints "Please wait 15 seconds between tests." and does not send. The limit resets when you reload the page. It is not an account quota, because there is no account.
What a failure looks like
If fetch throws, the page prints "Request failed:" plus the error message, then: "The server may block browser requests (CORS), be offline, or need credentials." A missing CORS header is the usual reason a public MCP server still fails in a browser. This tester cannot bypass that. It does not relay the request through MCPwell.
The result is written into the pre element on the page. Leaving the page clears it. We do not receive or store the URL or any responses.
Use a fact sheet on this directory when you want the registry's declared transport and credentials instead of a live probe. The tester only tells you what that one endpoint answered for initialize and tools/list from your browser, at the moment you clicked Test.
A check printed on a fact sheet is a separate run of these same two methods, from MCPwell, against one public https URL. The date and the HTTP result are on that fact sheet. Verified on MCPwell means that run returned both results. It does not mean the browser tester succeeded, and it does not mean a tool was called.
FAQ
Which MCP methods does this tester send?
Only initialize, then tools/list if initialize returns a result. The script keeps an allow-list of those two method names and throws before sending anything else.
Does the tester call a tool or store the response?
No. It never sends tools/call. The browser fetch uses credentials omit and cache no-store. Nothing is written to localStorage, a cookie, or a server on our side. The result stays in the page until you leave it.
Which URLs are rejected before a request?
The URL must be https. Hosts that start with localhost, 127., 10., 192.168., or a 172.16 through 172.31 private address are rejected in the browser before fetch runs.
What does a failure usually mean?
The page prints the HTTP status when the browser receives one. A 401 gets an extra line that the server requires sign-in and this tester does not accept credentials. A network failure names CORS, the server being offline, or credentials as the likely causes. The request aborts after 10 seconds.