Terms / 29 July 2026

Use the result as a review, not a verdict.

The free scanner reports static rubric findings from an MCP tool manifest. It is engineering guidance, not a guarantee of model behaviour, runtime quality, security, or compliance.

Using the scanner

Submit only a public MCP endpoint that you are permitted to inspect. Do not use the scanner to bypass authentication, probe a private network, overload a service, or interfere with another system.

The scanner performs initialization and tool-list requests. It does not execute listed tools. A server owner remains responsible for how their endpoint responds to those standard protocol requests.

What a score means

A score reflects the published toolsurface rubric and the manifest returned at scan time. The checks are heuristics. They can produce false positives, miss important problems, or become outdated as MCP and client behaviour change.

Token figures are estimates based on serialized JSON size. Cost figures are illustrations using stated traffic, price, and caching assumptions. They are not billing forecasts.

What it does not mean

• It is not penetration testing, vulnerability scanning, or a security certification.
• It does not execute tasks or measure real task completion.
• It does not endorse or condemn the server, its operator, or its software.

Paid work

Any paid review, repair, or monitoring work is governed by a separate written scope, price, delivery plan, and acceptance criteria agreed before work begins. The prices on the site are starting points, not an automatic engagement.

Availability and corrections

The free service may change, pause, rate-limit, or stop without notice. If a result or published figure appears wrong, email kurt@toolsurface.dev. Substantiated corrections will be made plainly.