Connect to your MCP server with no credentials at all and see exactly what it hands over. It is rarely what people assume.
Once the transport is right, the remaining problem is that nobody can see what your server does. MCP Showcase turns the same URL into a live playground with documentation for every tool.
Deliberately without a token — that is the test.
No credentials, no headers, exactly what someone who found your URL would send.
Which tools are listed, whether anything is served over plain HTTP, and how the surface grades.
This page connects to your MCP server with no credentials — no token, no headers, nothing — and
reports exactly what comes back. It is the same handshake and tools/list call any
MCP client makes on connecting, so it is traffic your server already accepts from every agent
that uses it.
The answer is often not what people expect, because the tool list and the tool calls are usually protected separately, and only the second one gets attention.
A server that lists its tools anonymously and only rejects the calls has still handed over a map:
internal_billing_adjust, prod_db_query, delete_tenant.
That is a description of your systems, available to anyone who finds the URL. If the calls are
protected, the list usually should be too.
They end up in config files, in logs, in screenshots and in support tickets. Treat the endpoint as public and put the control at the server rather than relying on the address being unguessable — it will not stay unguessable.
A static bearer token authenticates, which is most of the job, but rotation and revocation become yours to handle, and it is only as safe as the transport carrying it. A token over plain HTTP is not protection — it is a credential broadcast to everything on the path, which is why that combination is flagged as critical in the result.
Once a client can reach your server, the remaining problem is that nobody can tell what it does. A tool list is not a demonstration, and a prospect will not install a client to find out. MCP Showcase points at the same URL and produces a live playground with generated documentation for every tool, so evaluating your server takes a click.