Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/fabioc-aloha/Alex_Skill_Mallnpx agentmods add skills/fabioc-aloha/alex_skill_mall/mcp-server-testingWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/fabioc-aloha/alex_skill_mall/mcp-server-testing)<a href="https://agentmods.dev/skills/fabioc-aloha/alex_skill_mall/mcp-server-testing"><img src="https://agentmods.dev/badge/skills/fabioc-aloha/alex_skill_mall/mcp-server-testing/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/fabioc-aloha/alex_skill_mall/mcp-server-testing"><img src="https://agentmods.dev/badge/skills/fabioc-aloha/alex_skill_mall/mcp-server-testing.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00040 | $0.00937 |
| Opus 5.5 | $0.00016 | $0.00375 |
| Sonnet 5.5 | $0.00008 | $0.00187 |
| Haiku 4.5 | $0.00004 | $0.00094 |
Grade A, and why
mcp-server-testing scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 112 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Test an MCP Server
Two different questions. Does it respond correctly? is testing. Can an agent accomplish a task with it? is evaluation. A server can pass the first completely and fail the second, and the second is the one users feel.
The Inspector
An interactive client that lists your tools, calls them with arguments you supply, and shows the raw protocol traffic.
# TypeScript
npm run build && npx @modelcontextprotocol/inspector ./dist/server.js
# Python
python -m py_compile your_server.py
npx @modelcontextprotocol/inspector -- python your_server.py
# Any executable
npx @modelcontextprotocol/inspector /path/to/server
If a tool does not appear in the Inspector, no agent will see it either. Check this before suspecting anything subtler.
Pre-Ship Checks
- Every tool has a description saying when to use it, not only what it does
- Errors return actionable text with
isError: true - I/O is async, and paginated wherever results can grow
- Nothing writes to stdout on a stdio server
- Annotations are declared, especially
destructiveHint - Input schemas carry constraints, so bad input fails at the boundary
Evaluation
Testing proves the server responds. Evaluation proves an agent can use it — and it is the only way to discover that a tool description is technically accurate and practically useless.
Write ten questions requiring real tool use, then answer each yourself so you hold ground truth. Each question should be:
- Independent — not reliant on another question's answer
- Read-only — no destructive operations
- Multi-step — several tool calls and some exploration
- Realistic — something a person would actually ask
- Verifiable — one clear answer, checkable by string comparison
- Stable — the answer will not drift next week
<evaluation>
<qa_pair>
<question>Which repository had the most merged pull requests last quarter, and how many?</question>
<answer>servers, 47</answer>
</qa_pair>
</evaluation>
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 112 lines · 40 tokens per session scan A 098d5c72222e
mcp-server-testing is a skill published in the GitHub repository fabioc-aloha/Alex_Skill_Mall (5 stars, last pushed yesterday), licensed MIT. It adds 40 tokens to every session and 937 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-14.
Other skills, from other repositories
qa
Systematic QA testing of a web application: diff-aware, tiered, with fix-and-verify loop.
generate-tests
Generate comprehensive tests for specified code.
repository-consumer-proof
Verify ai-agents hooks, installed dispatch, and behavior beyond green builds. Do NOT use for PR blockers (use repository-pr-recovery).
pr-quality-qa
Judge a local diff on test coverage, error handling, and whether the tests would fail if the code regressed, and return a PASS/WARN/CRITICALFAIL verdict. Use when you say qa review my changes, run the qa gate, or are these tests good enough. Do NOT use to run all six axes (use pr-quality-all), and do NOT use to write…
desktop-testing-electron
E2E testing with Playwright, main process unit testing, IPC testing, dialog/menu mocking, CI headless setup.
api-integration-test
Create, maintain, and run gated Go integration tests for internal APIs and service-to-service clients (HTTP/gRPC). Use for endpoint verification, contract checks with real runtime config, opt-in execution, timeout/retry safety, and integration failure triage in Go services.