Verifier MCP server
{
"mcpServers": {
"sri": {
"type": "http",
"url": "https://sri-test.biz/mcp"
}
}
}{
"mcpServers": {
"sri": {
"type": "http",
"url": "https://sri-test.biz/mcp"
}
}
}{
"mcpServers": {
"sri": {
"type": "http",
"url": "https://sri-test.biz/mcp"
}
}
}{
"servers": {
"sri": {
"type": "http",
"url": "https://sri-test.biz/mcp"
}
}
}{
"mcpServers": {
"sri": {
"type": "http",
"url": "https://sri-test.biz/mcp"
}
}
}file .mcp.json (in your project root)file claude_desktop_config.jsonfile ~/.cursor/mcp.jsonfile .vscode/mcp.jsonfile ~/.codeium/windsurf/mcp_config.jsonversion 0.4.0
What it does
SRI reads MCP server source code from the official registry and reports what it does, anchoring each finding to specific file locations with quoted code. It helps developers understand what an MCP server will do before connecting it to their agent, covering 2,238 servers with no authentication required.
- Check an MCP server for credential access, network egress, install scripts, prompt injection surfaces, obfuscation, typosquatting, or excessive permissions before adding it to your agent.
- Get a risk level and detailed findings with code citations to decide whether to trust a server.
- Report incorrect findings about a server you maintain through a dispute form.
Tools this server exposes
| Tool | Does |
|---|---|
| check_mcp_server | Analyzes an MCP server by name and version from the registry, returns a risk level and findings with file locations and code evidence. |
Before you enable it
An MCP server runs with whatever access you give it. Start with a development account rather than production, and check which tools the server exposes before you let an agent call them unattended.