mcp-server-testing

mcp-server-testing is a skill for Claude Code, Codex from fabioc-aloha/Alex_Skill_Mall. It costs 40 tokens per session (937 once invoked), scanned A, original, MIT.

A testing and evaluation guide for Model Context Protocol (MCP) servers. An MCP server exposes tools that an AI agent can call; the guide checks both whether those tools respond correctly and whether an agent can use them to complete tasks.

In plain words
What is it for?
Use it with the MCP Inspector to list and call tools, inspect protocol traffic, check schemas and errors, and run an evaluation set for real agent tasks.
Why use it?
A server may return technically correct responses while still being confusing or unusable for an agent. The guide helps reveal missing tools, poor errors, unsafe annotations, and invalid input handling before release.

Skill for Claude CodeCodex

Written for no agent in particular: nothing here depends on one.

Needs its repository: it runs a file that does not travel with it, so clone the repository first. The line is npm run build && npx @modelcontextprotocol/inspector ./dist/server.js.

Good fit Use it with the MCP Inspector to list and call tools, inspect protocol traffic, check schemas and errors, and run an evaluation set for real agent tasks.

Compare 6 skills from other repositories ↓
Install

Getting it into your agent

It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.

Clone the repo
git clone --depth 1 https://github.com/fabioc-aloha/Alex_Skill_Mall
agentmods
npx agentmods add skills/fabioc-aloha/alex_skill_mall/mcp-server-testing

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for mcp-server-testing

README.md
[![agentmods](https://agentmods.dev/badge/skills/fabioc-aloha/alex_skill_mall/mcp-server-testing/github.svg)](https://agentmods.dev/skills/fabioc-aloha/alex_skill_mall/mcp-server-testing)
Your own site
<a href="https://agentmods.dev/skills/fabioc-aloha/alex_skill_mall/mcp-server-testing"><img src="https://agentmods.dev/badge/skills/fabioc-aloha/alex_skill_mall/mcp-server-testing/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for mcp-server-testing

Your own site · 80×15
<a href="https://agentmods.dev/skills/fabioc-aloha/alex_skill_mall/mcp-server-testing"><img src="https://agentmods.dev/badge/skills/fabioc-aloha/alex_skill_mall/mcp-server-testing.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 40 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 937 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00040 $0.00937
Opus 5.5 $0.00016 $0.00375
Sonnet 5.5 $0.00008 $0.00187
Haiku 4.5 $0.00004 $0.00094

Measured 1mo ago against content hash 098d5c72222e, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

mcp-server-testing scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

plugins/ai-agents/mcp-toolkit/skills/mcp-server-testing/SKILL.md · 112 lines

How it starts

The opening of the file, as written. The whole thing — 112 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Test an MCP Server

Two different questions. Does it respond correctly? is testing. Can an agent accomplish a task with it? is evaluation. A server can pass the first completely and fail the second, and the second is the one users feel.

The Inspector

An interactive client that lists your tools, calls them with arguments you supply, and shows the raw protocol traffic.

# TypeScript
npm run build && npx @modelcontextprotocol/inspector ./dist/server.js

# Python
python -m py_compile your_server.py
npx @modelcontextprotocol/inspector -- python your_server.py

# Any executable
npx @modelcontextprotocol/inspector /path/to/server

If a tool does not appear in the Inspector, no agent will see it either. Check this before suspecting anything subtler.

Pre-Ship Checks

  • Every tool has a description saying when to use it, not only what it does
  • Errors return actionable text with isError: true
  • I/O is async, and paginated wherever results can grow
  • Nothing writes to stdout on a stdio server
  • Annotations are declared, especially destructiveHint
  • Input schemas carry constraints, so bad input fails at the boundary

Evaluation

Testing proves the server responds. Evaluation proves an agent can use it — and it is the only way to discover that a tool description is technically accurate and practically useless.

Write ten questions requiring real tool use, then answer each yourself so you hold ground truth. Each question should be:

  • Independent — not reliant on another question's answer
  • Read-only — no destructive operations
  • Multi-step — several tool calls and some exploration
  • Realistic — something a person would actually ask
  • Verifiable — one clear answer, checkable by string comparison
  • Stable — the answer will not drift next week
<evaluation>
  <qa_pair>
    <question>Which repository had the most merged pull requests last quarter, and how many?</question>
    <answer>servers, 47</answer>
  </qa_pair>
</evaluation>

Read the full file on GitHub · 112 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 1mo ago First seen · 112 lines · 40 tokens per session scan A 098d5c72222e

Subscribe to this mod's changes

mcp-server-testing is a skill published in the GitHub repository fabioc-aloha/Alex_Skill_Mall (5 stars, last pushed yesterday), licensed MIT. It adds 40 tokens to every session and 937 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-14.