See what a site's AI agent endpoints actually offer, and whether they say it consistently. Lists every MCP tool with its declared behavior and every A2A skill, then checks the discovery cards, the browser preflight, the GET answer and both MCP protocol generations. Read-only: it lists capabilities and never runs one.
/.well-known/mcp/server-card.json, /.well-known/mcp.json and /.well-known/agent-card.json, follows the endpoints they name, and falls back to /mcp and /a2a.For MCP the inspector sends only discovery and listing requests: initialize and its notifications/initialized, ping, tools/list, resources/list and prompts/list when the server advertises them, the 2026-07-28 server/discover, and a DELETE to close any session the server opened. For A2A it reads the agent card and sends only an OPTIONS and a GET. It never calls a tool, reads a resource, requests a prompt or sends an A2A message, so nothing on the other side acts.
An MCP client may send GET to open a server-to-client stream. The server must answer with an event stream or 405 Method Not Allowed, and a 405 must carry an Allow header. A browser preflight (OPTIONS) that lists GET while GET is always 405 breaks nothing in a browser, because GET is a CORS-safelisted method, but it tells people and scanners two different things.
Each MCP tool should have a name of 1 to 128 letters, digits, _, - or ., unique on its server, a description the model can choose it by, and an inputSchema that is a JSON Schema object of type object. Its annotations say whether it only reads (readOnlyHint) or can destroy something (destructiveHint); a tool marked both is contradicting itself. The server card's tool list should match what tools/list returns, ping should get an empty answer, and a notification should get 202 Accepted with no body. An A2A card needs a name, description, version, interfaces, capabilities, defaultInputModes, defaultOutputModes and skills, and each skill an id, name, description and tags. Annotations and cards are the owner's own statements: the inspector checks that they are complete and consistent, not that they are true.
MCP revisions up to 2025-11-25 open with an initialize handshake. The 2026-07-28 revision has no handshake: every request carries its own protocol version, and server/discover reports what the server supports. A server can serve both, so the inspector tests each in its own dialect. Asking for 2026-07-28 through initialize gets an older version back, correctly.
Protocol requests go without an Origin header, like desktop and server-side clients. The MCP spec has servers refuse an untrusted Origin to defend against DNS rebinding, so a refused browser preflight is a choice, not a fault, unless you want browser-based agents to connect.
The story behind these checks: One CORS header, 28 sites. New to MCP? MCP servers for small business.
Run it against sites you own or have permission to test. One run sends about a dozen requests from jwatte.com's server, with a timeout on each and a cap on how much of each answer it reads. Private and internal addresses are refused. Free, no signup, nothing stored.