Atlas / MCP servers / msfeldstein / Test Servers

Test ServersCAUTION

Name: Test Servers
Author: msfeldstein

mcp/msfeldstein/test-servers

MCP server by msfeldstein · Audited 2026-10-08

⚑ Report / re-scan Source ↗

Verdict

CAUTION

Grade

Trust score

77 /100

Exposed tools

71 65r · 4w · 2d

Transport

sse · stdio · streamable-http

License

—

Stars

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

A collection of test servers implementing the Model Context Protocol (MCP).

🚀 Quick Install Gallery

Visit our [GitHub Pages Gallery](https://msfeldstein.github.io/mcp-test-servers/) for one-click install buttons that work directly with Cursor!

Manual Installation

npx -y @msfeldstein/mcp-test-servers

Development

Use the cli.js directly for development

{
"mcpServers": {
"test-server": {
"command": "/Users/feldstein/Source/mcp-test-servers/src/cli.js",
"args": [
"ping"
],
"env": {}
}
}
}

Available Servers

all-types: Demonstrates various tool parameter types supported by MCP
bad-param: Server with an intentionally malformed parameter name
big-response: Server that returns large responses
broken-tool: Server with intentionally broken tool
broken-schema: Server with invalid JSON schema using oneOf/allOf/anyOf at top level
broken-schema-fastmcp: FastMCP server with genuinely broken schemas using oneOf/allOf/anyOf at top level
crash-on-startup: Server that crashes on startup
combined: Server with tools and resources
duplicate-names: Server with duplicate names for resources
elicitation: Server demonstrating MCP elicitation feature - requests user information (name, age, contact details, preferences) through structured forms
enum-param: Tool has enum string parameter
integer-anyof-bug: Reproduces Cursor's integer validation bug with anyOf schema - parameters with {"anyOf": [{"type": "integer"}, {"type": "null"}]} fail validation with 'got number' error
env-check: Checks for SHOULD_RUN environment variable being passed properly
env-echo: Echoes the environment variables
gpt5-breaker: Server with SQL query execution tool using complex parameter validation
graphing: MCP Apps server with show-graphing-ui; UI renders an inline chart with Chart.js
headers: FastMCP server that safely returns HTTP he

Read from source at commit b57ad1b2f495OBSERVED · 2026-10-08

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add mcp-test-servers --env ACCESS_TOKEN_EXPIRY_SECONDS=${ACCESS_TOKEN_EXPIRY_SECONDS} --env AUTH_SERVER_PORT=${AUTH_SERVER_PORT} --env AUTH_SERVER_URL=${AUTH_SERVER_URL} --env DESCRIPTION_TOKENS=${DESCRIPTION_TOKENS} -- npx -y @msfeldstein/[email protected]

claude-desktop

{
  "mcpServers": {
    "mcp-test-servers": {
      "command": "npx",
      "args": [
        "-y",
        "@msfeldstein/[email protected]"
      ],
      "env": {
        "ACCESS_TOKEN_EXPIRY_SECONDS": "${ACCESS_TOKEN_EXPIRY_SECONDS}",
        "AUTH_SERVER_PORT": "${AUTH_SERVER_PORT}",
        "AUTH_SERVER_URL": "${AUTH_SERVER_URL}",
        "DESCRIPTION_TOKENS": "${DESCRIPTION_TOKENS}"
      }
    }
  }
}

Exposed tools (71)

65 read · 4 write · 2 destructive. Blast radius: 2 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.

Tool	Risk	Description
`add`	write
`all_types_tool`	read
`analyze_text`	read
`another-missing-type`	read	Another tool with missing type field
`ask-favorite-color`	read	Ask the user to select their favorite color from a list (raw enum values)
`ask-name`	read	Ask the user for their name
`ask-programming-language`	read	Ask the user to select their favorite programming language with user-friendly display names
`bad-param`	read
`bug-status`	read	Check if the OAuth bug has been reproduced
`characterName`	read	The name of the main character in the story
`crash`	read
`debug-oauth`	read	Returns OAuth debugging information
`delayedPing`	read
`delete-project`	destructive	Delete a project
`divide`	read
`dynamic_feature`	read
`echo`	read
`echo_env_var`	read	Echoes the MY_ENV_VAR environment variable
`echo_mcp_roots`	read	Echoes back the MCP roots provided by the client
`echo_structured`	read
`echo_with_params`	read
`env_echo`	read
`execute-sql`	write
`factorial`	read
`fizzbuzz`	read
`format_data`	read
`generate_big_response`	read
`generate_image`	read	A tool that returns an image of Sonic the Hedgehog
`get-headers`	read	Returns the headers from the last request
`get-info`	read
`get-resource-list`	read	Returns a list of all available resources as resource links
`get-session-info`	read	Get session information including time until expiry
`get-time`	read
`get_mixed_resources`	read	Returns both text and image content
`location`	read	The location where the story takes place
`log-to-stderr`	read
`long-running-ping`	read
`long-running-task`	read	Executes a long-running task with real-time progress tracking
`long-running-task-with-message`	read	Demonstrates a long running operation with progress updates and messages
`long-running-task-with-no-total`	read	Executes a long-running task with real-time progress tracking
`long_running_progress`	read
`makeRequest`	read
`many-resources-tool`	read	Many Resources Tool
`missing-type-tool`	read	A tool with missing type field
`multi-step-elicitation`	read	Ask for a couple of elicitations about pizza
`multiply`	read
`number-param`	read
`optionalTool`	read
`parse_bugsnag_error_url`	read
`personalized-story`	read	Generate a personalized story based on a character name and location
`ping`	write	Simple ping to trigger a request and log headers
`power`	read
`root-echo`	read
`safe_header_info`	read	Safely get header information without raising errors.
`search_documentation`	read
`simple_ping`	read	A simple tool that returns
`sqrt`	read
`start-notification-stream`	write	Starts sending periodic notifications
`static-greeting`	read	A static greeting prompt that always returns the same message
`status`	read
`subtract`	read
`terminate-session`	destructive
`test-anyof-integer`	read
`test-both-params`	read
`test-edge-cases`	read	Test tool for edge case scenarios
`test-simple-integer`	read
`test_all_elicitations`	read	Tests all different elicitation input types
`toggleTool`	read
`toggle_dynamic_tool`	read	Toggles the availability of the dynamic_feature tool
`token-info`	read	Returns information about the current access token expiration
`whoami`	read	Returns information about the authenticated user

Trust audit

CAUTIONgrade C · trust 77/100 Install with care. The audit found things worth knowing before you trust its output.

Layer	What it checks	Result
L0	Provenance & inventory	WARN
L1	Static analysis of the code	WARN
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	WARN
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: UNDECLARED (1 observation(s))
Network: declared (1 observation(s))
Shell: none-observed
Dependencies: not all pinned
Secrets in source: none-found

Findings (14)

MEDIUMInventory / provenance · inv.binary · CWE-1104

.DS_Store

.DS_Store

Why it matters. a compiled or binary member cannot be reviewed from source

Fix. ship source, or explain the binary in the README