mcp-fuzzSAFE
Runtime behavioral testing for MCP servers: calls every tool with schema-derived inputs and checks whether it actually behaves the way its description and schema claim.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Runtime behavioral testing for MCP servers.
Real output from a live `--include-destructive` run against the official [`@modelcontextprotocol/server-memory`](https://github.com/modelcontextprotocol/servers/tree/main/src/memory) reference server — not a synthetic example.
`mcp-doctor` reads an MCP server's source code and checks whether its tools are well-documented. mcp-fuzz does the opposite: it actually launches the server and calls its tools, with inputs derived from each tool's own declared JSON schema, and checks whether the server behaves the way that schema and its description claim — does a missing required field get a structured error back, or does the server crash? Does a wrong-typed field get rejected cleanly, or does it hang?
Static analysis can't see any of that. Only running the code can. It also measures things static analysis structurally can't: how long each tool actually takes to respond (Latency check), how large its response actually is (Response size check) and what that adds up to across a whole session (Token cost estimate), whether it behaves correctly when several callers hit it at once (Concurrency check), whether a resource actually stays deleted once a tool says it deleted it (Resource lifecycle check), and whether deleting one resource leaves another that referenced it orphaned (Cross-resource lifecycle check) — all opt-in except latency, response size, and token cost, which need no flag.
It still deliberately stops short of judging whether a successful call's res
9cb79bc518a2OBSERVED · 2026-10-12Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add mcp-runtime-check --env REQUIRED_TEST_KEY=${REQUIRED_TEST_KEY} -- uvx mcp-runtime-check{
"mcpServers": {
"mcp-runtime-check": {
"command": "uvx",
"args": [
"mcp-runtime-check"
],
"env": {
"REQUIRED_TEST_KEY": "${REQUIRED_TEST_KEY}"
}
}
}
}Exposed tools (24)
12 read · 7 write · 5 destructive. Blast radius: 5 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
always_crashes | read | Raises unconditionally, even on schema-valid input — the SDK |
bloated_but_fine | read | Returns a huge response instantly — not slow, not a crash, only |
crashes_on_bad_input | read | Divides 100 by value. Crashes (unhandled exception) if value is missing or the wrong type. |
create_item | write | Creates an item and returns its id as JSON — part of a well-behaved |
create_member | write | Creates a member referencing a real team id — the child half of the |
create_project | write | Creates a project and returns its id as JSON — the parent half of a |
create_task | write | Creates a task referencing a real project id — the child half of the |
create_team | write | Creates a team and returns its id as JSON — the parent half of a |
create_ticket | write | Creates a ticket and returns its id as JSON — part of a deliberately |
delete_everything | destructive | A destructive tool that should be skipped by default. |
delete_item | destructive | Deletes an item by id for real. |
delete_project | destructive | Deletes a project for real, but — deliberately, the bug this pair |
delete_team | destructive | Deletes a team for real, and — the correctly-behaved case — also |
delete_ticket | destructive | Deliberately buggy: validates the ticket exists and reports success, |
get_item | read | Reads an item by id — errors if it doesn |
get_member | read | Reads a member by id — correctly errors once its team (and thus this |
get_task | read | Reads a task by id — stays readable even once its project is |
get_ticket | read | Reads a ticket by id. |
hangs_forever | read | Never returns — simulates a server tool that hangs on certain input. |
kills_process | read | os._exit terminates the process immediately, bypassing all Python |
not_concurrency_safe | write | Uses a naive create-exclusive lock file with no retry/queue handling |
ping | read | Returns pong. |
slow_but_fine | read | Sleeps briefly then returns normally — well under the timeout, so it |
well_behaved | read | Echoes name count times. Validates its own inputs properly. |
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (1 observation(s))
- Network
- none-observed
- Shell
- none-observed
- Dependencies
- pinned
- Secrets in source
- none-found
Findings (5)
delete_everything, delete_item, delete_project, delete_team, delete_ticket
url = f"http://127.0.0.1:{port}/mcp"asyncio.run(_run_fuzz(command=sys.executable, url="http://127.0.0.1:1/mcp"))
Everything above runs once, offline: one synthetic-but-realistic call per tool, scored in a batch report. `LatencyGate` applies the identical two-signal design (absolute threshold + relative outlier)
**v0.10.1 (2026-09-24): fixed false "slow" and "bloated" flags on fast servers.** A local run on 10 servers that need no API keys (the MCP reference servers, `chrome-devtools-mcp`, `desktop-commander`
Gates applied: no_behavioural_pass.
9cb79bc518a2full audit observations/trust-audit/mcp-server/vishalhabib99__mcp-fuzz.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-12 | 9cb79bc518a2 | SAFE | B | 89 | first audit |
Questions
What is the mcp-fuzz MCP server?
Runtime behavioral testing for MCP servers: calls every tool with schema-derived inputs and checks whether it actually behaves the way its description and schema claim.
What tools does mcp-fuzz expose?
24 in total: 12 read-only, 7 that write, and 5 that can delete or overwrite (delete_everything, delete_item, delete_project, delete_team, delete_ticket). Every one is listed on this page with its risk.
Is mcp-fuzz safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B. Separately from the audit: 5 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does mcp-fuzz need?
It reads REQUIRED_TEST_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does mcp-fuzz run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on PyPI as mcp-runtime-check.
How current is this page?
The grade is for one exact copy of the source (9cb79bc518a2), read on 2026-10-12. The repository is watched and re-audited when it changes.