Is my MCP server exposed? How to check in five minutes

An MCP server is the program that lets an AI assistant use your tools. If it is reachable on the internet, the question is simple: what does a stranger get when they knock? This takes five minutes and needs nothing but a terminal. If you would rather not type, our free check runs the same steps for you.

1. Find the address

Most servers answer at a path ending in /mcp. Older ones use /sse. The address is whatever you pasted into Claude, Cursor or ChatGPT when you connected it, for example https://tools.example.com/mcp.

2. Open it in a browser

You are looking at the status code, not the page.

• 401 Unauthorized is the good answer. It means the server wants a sign-in before it does anything.
• 200, 400 or 405 tells you nothing yet. Many servers only react to a proper MCP request, which is the next step.
• 404 usually means the path is wrong. Try /mcp and /sse.

3. Send the first thing every client sends

Every MCP client opens with an initialize call. Send one with no token at all:

curl -i -X POST https://your-server.example.com/mcp \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json, text/event-stream' \
  -H 'MCP-Protocol-Version: 2025-06-18' \
  -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"check","version":"1"}}}'

• HTTP 401, ideally with a WWW-Authenticate header: protected. Strangers get nothing.
• HTTP 200 with a JSON reply containing "result" and serverInfo: open. You just started a session with no identity. Anyone can follow it with tools/list and then call whatever is listed.

If it is open and you meant it to be public, that can be fine, but then rate limits and a record of every call are not optional. If you did not mean it, go to step 5 now.

4. Check that real users can sign in

A protected server should also tell clients where to log in. The MCP authorization rules use a small discovery document, defined in RFC 9728, at /.well-known/oauth-protected-resource on your server's origin, sometimes followed by the server path. It names your authorization server. Open it in the browser. If it is missing, the 401 is a dead end: connectors in Claude and ChatGPT cannot start the sign-in and users end up pasting tokens by hand.

5. What to change

• If only you should reach it: bind it to 127.0.0.1 or your VPN, and close the port on the firewall. The internet never needs to see it.
• If others should reach it: put a real sign-in in front. OAuth 2.1 through the identity provider you already have, such as Keycloak, Auth0, Okta or Google, returning 401 plus WWW-Authenticate with a resource_metadata link, and the discovery document from step 4.
• One identity per agent. A shared key makes every caller the same person in your logs, and a leak means revoking everyone at once.
• Record every call with the name behind it. A sign-in keeps strangers out; it does not show you what signed-in agents do. That is the part most teams skip, and the part AriesView Security adds in two lines of code.

Do it again next month

Servers drift. A framework upgrade, a new reverse proxy, a teammate "just testing" without auth. Put the five minutes on a calendar, or bookmark the free check and paste the address.

All guides