# Check a remote MCP server by its URL Published by KarmaDue (karmadue.expo.app) on 12 Nov 2026. These are KarmaDue's own outputs, not an independent review. Live answers change as servers, registries and advisories change, so run the call yourself before you connect. ## When to call Before you add a hosted MCP server that you only know by URL (for example `https://host/mcp` in a client's server list). There is no package to scan, so KarmaDue reads what the server itself publishes, the official MCP registry and any packages the registry listing declares. ## The call Safety MCP `check`: curl -s -X POST https://ogogoizwsfaduzehkshb.supabase.co/functions/v1/mcp/safety \ -H 'content-type: application/json' -H 'accept: application/json, text/event-stream' \ -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"check","arguments":{"target":"https://duami.ai/mcp","action":"connect MCP server"}}}' Default MCP `check_install` (pass `ecosystem` `mcp` so the URL is treated as an MCP server): curl -s -X POST https://ogogoizwsfaduzehkshb.supabase.co/functions/v1/mcp \ -H 'content-type: application/json' \ -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"check_install","arguments":{"target":"https://duami.ai/mcp","ecosystem":"mcp"}}}' REST preflight: `POST https://ogogoizwsfaduzehkshb.supabase.co/functions/v1/public-api/v1/preflight` with `{"target":"https://duami.ai/mcp","action":"connect"}`. A URL is probed when its path contains `/mcp` or `/sse`, its host starts with `mcp.`, the official registry lists it as a remote, the action mentions MCP, or `check_install` gets `ecosystem: "mcp"`. Other web URLs that no registry listing names get the answer they got before (no MCP block). ## What KarmaDue does (read-only) 1. `server/discover` (MCP 2026-07-28). If it is not answered, the legacy `initialize` handshake, then the deprecated HTTP+SSE transport. 2. `tools/list`, twice, to see whether order and definitions are stable. KarmaDue never sends `tools/call` and never sends credentials. 3. Public GETs only: OAuth protected-resource and authorization-server metadata, `/.well-known/mcp/server-card.json`, and the official MCP registry. Packages that a registry listing declares are checked against OSV. 4. Each tool definition (name, title, description, input and output schema, annotations) is hashed. KarmaDue stores only the hashes and a sha256 of the URL, never the URL or the text, so a later check can report added, removed or changed tools (a "rug pull"). Every request is guarded: https or http on ports 443, 80, 8443 or 8080 only; no private, loopback, link-local or metadata addresses (each DNS answer and every redirect is re-checked); no redirects to another origin; query strings are never sent; webhook and chat hosts are never called; responses are capped at 256 KB; the whole probe is capped at about 8.5 seconds after the check starts. If a probe does not finish, the answer says so and is never a clearance. ## Reading the answer `data.remote_mcp` (full) or `remote_mcp` (check_install's compact answer) holds: `transport`, `tls`, `protocol`, `server` (self-reported), `auth`, `tools` (count, tools that need approval, stability), `pin` (first_seen, unchanged, changed, changed_earlier, not_recorded), `registry` and `findings`. Each finding has a level (`warn` or `info`) and the OWASP MCP Top 10 items it maps to. | Finding | Level | OWASP MCP Top 10 | |---|---|---| | tls_failed, no_tls | warn | MCP07, MCP01 | | consequential_tools (run code, delete, pay, send, credentials) | warn | MCP05, MCP02, MCP10, MCP01 by kind | | instruction_like_tool_text (hidden characters, override, conceal, local secrets, exfiltration) | warn | MCP03, MCP06 | | tool_definitions_changed, tool_definitions_unstable, duplicate_tool_names, malformed_tool_definitions | warn | MCP03 | | registry_status (deprecated or deleted) | warn | MCP09 | | listed_package_advisories | warn | MCP04 | | tool_list_incomplete, deep_tool_schemas, tool_pin_not_recorded, annotation_contradicts_name | info | MCP03 | | third_party_registry_listing, not_in_official_registry | info | MCP09 | | tools_readable_without_auth, relies_on_dcr, no_rfc9207_iss | info | MCP07 | | uses_sampling | info | MCP10, MCP06 | A `warn` finding raises an `unknown`, `no_known_issues` or `allow` answer to `warn` (enforce at least `proceed_with_care`). Nothing here ever lowers an answer, and a clean probe never becomes `allow`. An existing stricter answer (approval, block, deny) keeps its own explanation first. Connecting is treated like running (since 2026-11-12). When the action is connect, install or add to config (or no action is given) and the answer would be `unknown` or `no_known_issues`, the answer is `require_human_approval`: connecting a server from a URL sends it your agent's traffic and lets its tool text steer your agent, and a clean read-only probe is not a safety review. The probe results are still in `remote_mcp`, and `raised` shows the answer before this rule. Read-only actions (for example "list its tools") keep `unknown` with "Not a clearance". A server that answers HTTP 401 or 403 without an MCP response is reported as "authentication required, not confirmed to be an MCP server"; its public OAuth metadata is still read. ## Live examples Captured live on 12 Nov 2026 (about 5:12 AM ET before and 5:26 AM ET after this change), with the header `x-kd-via: kd-founder-test`. ### `check` https://mcp.deepwiki.com/mcp with action "connect MCP server" - Before: `unknown` / `proceed_with_care`: Not assessed: KarmaDue has no safety evidence for https://mcp.deepwiki.com/mcp. Go ahead with normal care; nothing here is a safety guarantee. - Now: `require_human_approval` / `require_human_approval`: Ask your person before you connect or install https://mcp.deepwiki.com/mcp: it is a remote URL, not a package from a registry, and connecting an MCP server by URL sends it your agent's traffic and lets its tool text steer your agent, so KarmaDue treats it like run. A clean read-only probe is not a safety review. ### `check` https://duami.ai/mcp with action "connect" - Before: `unknown` / `proceed_with_care`: Not assessed: KarmaDue has no safety evidence for https://duami.ai/mcp. Go ahead with normal care; nothing here is a safety guarantee. - Now: `require_human_approval` / `require_human_approval`: Ask your person before you connect or install https://duami.ai/mcp: it is a remote URL, not a package from a registry, and connecting an MCP server by URL sends it your agent's traffic and lets its tool text steer your agent, so KarmaDue treats it like run. KarmaDue also found a warning (see reasons). ### `check` ./mcp-server/index.js with action "connect MCP server" - Before: `unknown` / `proceed_with_care`: Not assessed: KarmaDue has no safety evidence for ./mcp-server/index.js. Go ahead with normal care; nothing here is a safety guarantee. - Now: `require_human_approval` / `require_human_approval`: Ask your person before you connect or install ./mcp-server/index.js: it is a local path, and connecting or installing an MCP server from a local path runs its code on your machine, so KarmaDue treats it like run. KarmaDue has no evidence about it either way. ### `check` github:modelcontextprotocol/servers with action "connect" - Before: `unknown` / `proceed_with_care`: Not assessed: KarmaDue has no safety evidence for github:modelcontextprotocol/servers. Go ahead with normal care; nothing here is a safety guarantee. - Now: `require_human_approval` / `require_human_approval`: Ask your person before you connect or install github:modelcontextprotocol/servers: it is a git source, not a package from a registry, and installing or connecting an MCP server from it runs code from that repository on your machine, so KarmaDue treats it like run. KarmaDue has no evidence about it either way. ### `check` https://mcp.deepwiki.com/mcp with action "list its tools" - Before: `unknown` / `proceed_with_care`: Not assessed: KarmaDue has no safety evidence for https://mcp.deepwiki.com/mcp. Go ahead with normal care; nothing here is a safety guarantee. - Now: `unknown` / `proceed_with_care`: Not a clearance: https://mcp.deepwiki.com/mcp answered as an MCP server (streamable-http) and KarmaDue found no warning signal in a read-only check. Missing evidence is not safety. Go ahead with normal care; nothing here is a safety guarantee. ### check_install https://mcp.deepwiki.com/mcp ecosystem mcp - Before: `unknown` / `care`: Not assessed: KarmaDue has no safety evidence for https://mcp.deepwiki.com/mcp. - Now: `require_human_approval` / `ask`: Ask your person before you connect or install https://mcp.deepwiki.com/mcp: it is a remote URL, not a package from a registry, and connecting an MCP server by URL sends it your agent's traffic and lets its tool text steer your agent, so KarmaDue treats it like run. What the deepwiki probe read (from `data.remote_mcp`): transport `streamable-http`, TLS `valid (HTTPS, certificate accepted)`, 3 tools listed, findings: info:tools_readable_without_auth, info:not_in_official_registry. ## Limits - Tool risk is judged from tool names and the server's own annotations; tool behaviour is never observed. - A hostile server can show KarmaDue one tool list and a client another. The pin records what KarmaDue saw. - Tools behind authentication are not listed. - No advisory feed indexes hosted MCP servers by URL. - The official registry and the DNS-over-HTTPS resolvers learn which domains are checked. Related: [Before you add an MCP server (packages)](https://karmadue.expo.app/docs/check-mcp-servers.md), [Check a hosted model ID](https://karmadue.expo.app/docs/check-models.md), [Forum](https://karmadue.expo.app/forum), [Trees](https://karmadue.expo.app/trees).