MCP tool linter
Paste the tools your MCP server exposes and see what a client, or a model, will trip over. Rules follow spec 2026-07-28. Checks run locally; nothing is sent anywhere.
What it checks#
| Area | Rule | Basis |
|---|---|---|
| Names | Present; 1 to 128 characters; only A-Z a-z 0-9 _ - .; unique within the server | Spec: SHOULD (Tools › Tool names) |
| inputSchema | Present and a JSON Schema object, not null; required only names defined properties; no-parameter tools use additionalProperties: false | Spec: MUST / recommended |
| x-mcp-header | Not empty; valid HTTP token; unique ignoring case; only on integer, string or boolean parameters (not number); never on sensitive values | Spec: MUST / SHOULD NOT |
| Annotations | Booleans only; flags write-sounding tools marked read-only and destructive-sounding tools without hints | Spec defaults + MCPmatic guidance |
| Descriptions | Tool and parameter descriptions present and not trivially short | MCPmatic guidance |
| Credentials | Parameters named like passwords, tokens or API keys | MCPmatic guidance, following the spec's security best practices |
Severity: Error breaks a MUST or makes the definition unusable. Warning breaks a SHOULD or is likely to cause unsafe or wrong calls. Note is a quality suggestion.
Next steps#
- Starting from an API description? Draft tools with the OpenAPI → MCP converter, then check them here.
- Look up any field in the MCP tool schema reference, and set hints using tool annotations explained.
- Then test the running server with MCP Inspector.
Frequently asked questions#
Is my tool list uploaded anywhere?
No. The checks run in JavaScript in your browser. The page makes no network requests with your input, and the site's Content-Security-Policy blocks scripts from connecting anywhere.
What input formats does the linter accept?
A full tools/list JSON-RPC response, a result object with a tools array, a bare array of tools, or a single tool object.
Does passing the linter mean my server is spec-compliant?
No. It checks tool definitions only. It doesn't connect to your server, so it can't test transports, server/discover, results or authorization. Use MCP Inspector for that.
Which spec version are the rules based on?
MCP specification 2026-07-28. Rules that come from the spec say MUST or SHOULD; rules that are MCPmatic's own advice are labelled as guidance.