Seven free Model Context Protocol tools

Build, secure and publish MCP servers.

Migrate stateless 2026 requests, then move through asynchronous tasks, interactive app metadata, configuration, security, OAuth and public Registry publishing.

MCP tool collection

2026 protocol migration

MCP 2026 Stateless Check

Validate server/discover, per-request _meta, standardized HTTP headers and leftover initialize or session behavior.

Check an MCP 2026 trace → Asynchronous work

MCP Task Trace

Validate working, input-required and terminal task states, polling metadata, lifecycle transitions and migration from the 2025 API.

Validate MCP Tasks → Interactive UI

MCP App Ready

Validate tool-to-UI links, ui:// resources, HTML profile MIME types, visibility, sandbox permissions and CSP origins.

Validate an MCP App → Configuration

MCP Config Lab

Convert MCP JSON and Codex TOML, or translate configurations among Claude Desktop, Cursor, VS Code, Gemini, and Codex.

Convert MCP configs → Security

MCP Config Guard

Scan configuration files for exposed secrets, risky shell commands, unpinned packages, broad scopes, and unsafe local paths.

Scan an MCP config → Authentication

MCP OAuth Lab

Validate protected resource metadata, authorization server discovery, RFC 9728 linkage, scopes, and PKCE S256 readiness.

Debug MCP OAuth → Publishing

RegistryReady

Generate and validate server.json metadata for the official MCP Registry, including packages, remote transports, versions, and the 4 KB limit.

Validate server.json →

Which MCP tool should you use?

Start with MCP Config Lab when a working server configuration needs to move between clients. Run the result through MCP Config Guard before sharing or committing it. If the server is remote and authenticated, use MCP OAuth Lab to review discovery and PKCE. When the server is ready for public distribution, finish with RegistryReady before running the official publisher.

Private browser processing

The tools are designed around static, client-side checks. Configuration text is processed in the browser unless a specific page clearly says that it needs to fetch a public URL.