Free tools Windows power users keep installed
One-click scans. No signup required.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
An HTTP 200 response confirms only that the HTTP exchange returned a successful status. It does not prove that an MCP method was recognized, that tools are available, or that a tool call would work. To check an MCP server without executing a tool, inspect the response body, confirm the protocol version and capabilities, and use tools/list when supported. A real execution check requires a separate, understood tools/call request.
What an HTTP 200 does—and does not—tell you
HTTP status belongs to the transport layer. MCP methods and results are represented at the protocol layer, so a 200 response alone is not proof of MCP success. Record the status, headers, content type, and body, then inspect whether the body is valid for the request and contains an MCP result or a JSON-RPC error. The Tools specification distinguishes protocol errors from errors reported by a tool implementation (Tools, 2025-06-18; Tools, 2025-11-25).
- Transport success: The HTTP exchange returned a successful status.
- Protocol success: The request received a valid protocol-level response, rather than a protocol error.
- Discovery or listing success: The server returned information about supported capabilities or available tools.
- Execution success: A tool call returned usable content without an error indicator.
These are different findings. In particular, neither a successful HTTP response nor a successful tool list establishes that a tool can execute successfully.
Check the protocol version before choosing a discovery flow
MCP discovery behavior depends on the protocol version and transport in use. The specification dated 2026-07-28 describes optional server/discover, which can report supported versions, capabilities, and server identity. The method is optional, so its absence is not by itself evidence that a server is broken. See the Discovery specification (2026-07-28).
#1 Best Overall
That revision also changes the client-server flow: its release notes describe retiring the earlier initialize/initialized exchange and the Mcp-Session-Id header, carrying protocol version and client metadata in per-request _meta, and adding optional server/discover. Do not combine examples from different versions as if they described one universal handshake. Check the 2026-07-28 specification release notes and the documentation for the actual transport and version you implement.
Earlier Tools documentation, including the 2025-06-18 specification, describes capability declaration, tools/list, and tools/call. It is useful background, but it should not be presented as the current normative flow when a newer revision applies.
Rank #2
Use a no-execution sequence to check what the server exposes
- Record the transport response. Capture the HTTP status, headers, content type, and response body. Treat the status as transport evidence only.
- Validate the protocol response. Check that the body parses, corresponds to the request, and contains the expected result or a JSON-RPC error. Keep protocol errors distinct from transport failures.
- Use discovery if the version supports it and the information is useful. With the 2026-07-28 specification,
server/discoveris an optional way to obtain supported versions and capabilities. Do not treat its reported server identity as verified. - Request the tool list if the server advertises the tools capability. Use
tools/listto enumerate exposed tools, and handle pagination where applicable. A successful response confirms the list returned to that request; it does not test invocation. - Report exactly what you checked. Separate transport status, protocol response, discovery outcome, and tool-list outcome. Include the protocol version and endpoint or transport, and note whether you did not make a tool call.
There is no universal HTTP status mapping for every unsupported MCP method or deployment. Follow the relevant transport and version documentation rather than assuming that every implementation signals unsupported methods in the same way.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Know the limit of a no-call check
Status inspection, protocol-response validation, discovery, and tools/list can establish that the endpoint responded and describe capabilities or tools it exposed. They cannot establish that a particular tool will run successfully. That requires a valid tools/call request and an inspection of its result.
| Check | Evidence it provides | What it does not establish |
|---|---|---|
| HTTP response | Transport status and response metadata | That an MCP method succeeded or a tool is usable |
server/discover, when supported |
Reported supported versions, capabilities, and identity | That tools are listed, callable, or trustworthy |
tools/list, when supported |
The tools exposed in the response to that request | That any listed tool executes successfully |
Safe tools/call |
Execution behavior and result for that specific request | Universal reliability or security beyond that request and context |
If you need execution evidence, make the call a deliberate test
Before invoking a tool, understand what it does and review its arguments. Prefer a safe, read-only operation; do not test with a request that mutates data or exposes sensitive information unless you are authorized to do so. The Tools specification advises input validation, access controls, rate limiting, output sanitization, timeouts, logging, and confirmation for sensitive operations. It says: “For trust & safety and security, there SHOULD always be a human in the loop with the ability to deny tool invocations.” See the Tools security guidance.
For a call that is appropriate to make, inspect both the protocol response and the returned tool result. The specification represents a tool-reported failure with isError: true; record that separately from a protocol error, which means the request could not be handled at the protocol level. A successful result is evidence for that call, not a guarantee about other arguments, future calls, or security.
Do not treat discovery metadata as a trust signal
The 2026-07-28 Discovery specification says serverInfo is self-reported and not verified by the protocol. It cautions that clients “SHOULD NOT rely on it for security decisions.” Discovery can describe a server; it does not authenticate the endpoint or attest that the server is safe. Make trust decisions using appropriate authentication and security controls, not descriptive metadata alone.
Report the result in separate layers
A useful verification note should state the protocol version and transport, then distinguish the outcome at each step. For example, say that the HTTP exchange returned 200, whether the protocol response was valid, whether discovery was available, and whether tools/list returned tools. If you did not call a tool, say that execution was not tested. If you did, identify the tested operation and arguments at a non-sensitive level and classify the outcome as a protocol error, a tool-reported error, or a successful result.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
