How do you check whether your MCP server is exposed, using an AI agent?

Install the connector, then ask your agent

AdminKit’s open-source adminkit-mcp connector (MIT, PyPI, MCP Registry id io.github.netbasecorp/adminkit-mcp) exposes check_mcp_endpoint as a real tool any MCP-capable AI agent can call. No account or hosted endpoint is required — you run it yourself:

uvx adminkit-mcp

Point your agent’s MCP client config at that command (stdio), add it to Claude Desktop, Claude Code, or any other MCP client, and ask it in plain language:

“Use check_mcp_endpoint to check whether https://mcp.example-internal-tool.test/mcp requires authentication, and tell me what tools it exposes if it doesn’t.”

The agent calls the tool with your URL as the url argument. See connect an AI agent to AdminKit’s MCP server if you haven’t installed and wired it up yet.

What the tool actually does

check_mcp_endpoint tries AdminKit’s live Check API first (/v1/check/mcp-endpoint); if that specific call is briefly unreachable, it falls back to a local, self-contained probe that speaks just enough MCP to do the same two things: send initialize with no credentials, and if that succeeds, send tools/list to read tool names and descriptions. It never sends tools/call — this is reconnaissance, not a scanner that exercises your tools. A hostname that resolves to a private, loopback, or otherwise internal address is refused outright by the live API’s SSRF guard, the same safety control behind the public MCP endpoint check tool page.

Example response (fixture)

This is a labelled fixture, not a live scan of anyone’s server: the exact response shape check_mcp_endpoint returns, matching the connector’s own open-source test suite (adminkit_mcp.probe.mcp_probe). Reproduce it yourself by running the command above against any MCP server you control. A server that correctly requires authentication comes back like this:

{
  "tool": "check_mcp_endpoint",
  "status": "ok",
  "result": {
    "url": "http://127.0.0.1:8900/mcp",
    "status": "ok",
    "summary": "initialize rejected the unauthenticated request.",
    "score": 100,
    "findings": [],
    "evidence": {
      "transport": "streamable-http",
      "auth_required": true,
      "www_authenticate": "Bearer realm=\"mcp\""
    }
  },
  "evidence": {
    "transport": "streamable-http",
    "auth_required": true,
    "www_authenticate": "Bearer realm=\"mcp\""
  },
  "fix_hint": null,
  "report_url": "https://adminkit.net/tools/mcp-check/?utm_source=mcp"
}

If initialize instead succeeds with no credentials, status becomes "fail", findings lists at least mcp.no_auth_required (and mcp.tools_exposed_anonymously once tools/list returns), and evidence adds the tool names the server revealed. How to read an MCP endpoint check result walks through reading an “open” result like that in depth, including why specific tool names matter more than the pass/fail label alone.

Why ask an agent instead of running the website check

Running the check through an agent means the result comes back as structured data (result, evidence, fix_hint, report_url) the agent can reason over directly — useful for an agent that monitors several MCP servers, gates a deploy on the result, or explains the finding to you in context, rather than you reading a web page and copying the answer back in by hand. The Model Context Protocol specification defines tools as exactly this: a mechanism for an agent to take a real, structured action and get a structured result back, not just render a page for a human. The same probe is also what AdminKit’s GitHub Action runs in CI, so a server that passes here will pass there too.

What to do with an open result

If your result shows the server accepted initialize with no credentials, that’s the signal to restrict network access or add authentication before anything else — any agent or script that finds the URL can currently read the tool list. The OWASP Top 10 for LLM Applications treats excessive agency and insecure plugin/tool design as named risk categories precisely because a tool list visible to an unauthenticated caller is a map of what that caller could ask an agent to do next if tools/call were also open. For the fuller hardening checklist beyond authentication alone, see how to secure an MCP server; for what AdminKit’s AI agent builders solutions page covers once you’re building the agent side rather than just checking exposure, see that page.

This guide is general information, not a security audit of your specific network — see our disclaimer for what AdminKit's guidance does and does not commit to.