Your credentials stay put
The tool authenticates from your machine with the token you already hold. Nothing is transmitted to a third party, so nothing has to be revoked afterwards.
Protocol diagnostics · runs on your machine
Test any server. Nothing leaves your machine.
A theme for tools that inspect, verify and grade — built around the one thing a hosted scanner cannot offer: the run happens where your credentials already live.
Last run
https://mcp.example.com/mcp
Ready, with room to improve
Nine phases · 76 checks · 50 requests · every finding tied to one of them
84/ 100Good
- Checks per run
- 76
- Requests to the server
- 50
- Credentials uploaded
- None
Figures are illustrative theme content. Replace them with your own instrument's real numbers and state the method you measured them by.
Why local
A scanner you upload to is a scanner you trust twice.
Handing an endpoint to a hosted tester means handing over whatever reaches it. For a server behind OAuth, that is a working credential. The alternative is not a weaker test — it is the same test, run from inside your own trust boundary.
Your network is the network
A server on a private address, behind a VPN or inside a CI runner is reachable exactly as your agents will reach it. A hosted scanner can only test what it can route to.
The evidence stays with you
Wire logs, headers and timings are written beside the report. You can read them, diff them and keep them, rather than trusting a summary of a run you cannot inspect.
Severity ledger
Every deduction named.
A grade with no arithmetic behind it is a brand, not a measurement. The ledger shows the categories, their weights and what each one lost.
| Area | Weight | Result | Deduction |
|---|---|---|---|
| Handshake | 20 | Pass | 0 |
| Tool catalogue | 25 | Review | −6 |
| Error semantics | 30 | Review | −10 |
| Transport safety | 25 | Pass | 0 |
Evidence
Nothing passes without a request that showed it.
Each finding carries the numbered exchange that produced it, so a reader can follow a verdict back to the bytes on the wire instead of taking it on faith.
Request 017 · 184 ms
Initialise completed
HTTP/2 200
content-type: application/json
x-request-id: req_017Request 031 · 226 ms
Schema drift found
tools/list
expected: inputSchema
received: schemaMethod
Nine phases, in the order an agent meets them.
The sequence matters: a catalog check means nothing if the handshake never completed, and a latency figure means nothing if half the calls failed.
- Resolve and connect
- Negotiate transport
- Complete handshake
- Read capabilities
- List resources
- Inspect tools
- Exercise failures
- Measure latency
- Write evidence
The report
One document, two readers.
An executive summary sits above the fold — verdict, score, what to fix first. The full findings and their evidence follow. One document, so there are not two that drift apart, and it prints to a PDF a board can read.
Scout is a diagnostic-instrument theme for tools that inspect and grade something: a protocol implementation, a server, a dependency graph, an API contract. It is built for the moment after the run finishes, when a verdict has to be delivered to two audiences at once — somebody deciding whether to adopt, and somebody who has to fix it.
The design puts the readout first. A verdict line, a score with its grade, and the shortest honest description of what is wrong sit above everything else, because that is what a reader wants before they want detail. Below it, the method: phases in the order they ran, findings with severity encoded in form as well as colour, and the numbered evidence that produced each one.
The palette is an instrument palette — a single probe accent against a cool neutral, with severity colours kept separate from it so that "this is the brand" and "this is broken" never compete for the same signal. Type is a system stack by design: the content security policy this theme ships with forbids third-party requests, and a web font would be one.