Updates
What changed
What we added or changed on the site, newest first, each with its date. Mistakes in our own data or wording are in the corrections log. Updates, reports and corrections all appear in our Atom feed.
New free command: find the MCP servers on your machine
protocolprobe-discover 0.1.0 is on npm (published 2026-10-20, UTC). Run npx protocolprobe-discover to list the MCP servers configured in Claude Desktop, Claude Code, Cursor and VS Code on your machine and see, offline, which of them are in the official MCP registry, with a link to each one's page here. It reads config files only, sends nothing anywhere and never prints setting values, arguments or anything that looks like a credential. Tested on Windows; macOS and Linux paths are covered by tests, not by a run on those systems.
Add a server to Cursor in one click
Server pages now have an "Add to Cursor" button: an install link in the format Cursor documents, holding the same config the page shows. VS Code documents no such link, so the page also gives its `code --add-mcp` command for a Bash or zsh terminal. Neither is offered when the server needs a value of your own, such as an API key: then you paste the config and fill it in. Both are built only from the server's registry entry. Phones: long tool names on server pages now wrap instead of widening the page.
Self-test command 0.4.0: use it in CI
protocolprobe-selftest 0.4.0 is on npm (published 2026-10-19, UTC). --fail-on-finding makes the command exit with code 5 when a check needs attention, so a CI job fails; without it nothing changes. --sarif also writes the result as a SARIF 2.1.0 file, the format GitHub code scanning reads, with secret-looking values hidden and without your command line. The file is written on your machine; uploading it is your own step. The command still sends nothing to us.
Self-test command 0.3.0: servers that need a credential
protocolprobe-selftest 0.3.0 is on npm (published 2026-10-19, UTC). If your own server at a URL needs a token, you can give it from an environment variable (--bearer-env or --header-env); there is no option that takes the value itself. The one-time proof is still required. The credential is sent only to the URL you proved, never printed, never written to the report and never stored. The command still runs on your machine and sends nothing to us.
Self-test command 0.2.0: test your own server at a URL
protocolprobe-selftest 0.2.0 is on npm (published 2026-10-19, UTC). It can now test your own Streamable HTTP server at a URL, after a one-time proof: the command prints a value, you add it to your server's MCP instructions, and the next run reads it on the same connection it tests with. The value works once and only for that exact URL; no redirect is followed and no token is sent. The command still runs on your machine and sends nothing to us. We ran the whole flow against our own test server on Vercel, then deleted it.
Self-test command 0.1.2
protocolprobe-selftest 0.1.2 is on npm (published 2026-10-19, UTC). Through a proxy such as mcp-remote, the process the command starts is the proxy, not your server, so check 4 (leaked environment values) and check 11 (leaks in log messages) now show N-A and are not counted. Version 0.1.1 wrongly counted check 4 as passed there; the corrections log has the details.
Self-test command 0.1.1
protocolprobe-selftest 0.1.1 is on npm (published 2026-10-18, UTC). It waits up to 180 seconds for a server to start, including a first npx or uvx download, and the limit can be changed; a whole run stops after 600 seconds; when a server cannot start it shows the server’s last error lines, with values that look like secrets hidden, and a hint for causes we have reproduced. The page now has Python examples. Before this release we ran the command once on 50 random registry packages in our own sandbox: 32 gave a full result. We publish no result for any of those servers; the security page describes that run.
About page, and plainer wording about what we do
New About page: who runs ProtocolProbe, why it exists, how it is meant to be paid for, and what money will never change. We also removed wording that said security-check results would be published once verified and that described the site as security testing. We call no server’s tools, and we do not publish security-check outcomes for named servers.
Record checks, rankings and a new order on server pages
Every server page now leads with “N of M record checks met”: nine facts read from public records, counting only met and not met. It is a count of facts, not a grade and not a statement that a server is safe. New rankings by downloads, GitHub stars and servers meeting all nine checks, and a rank on each server page wherever a rank means something.
The dataset can be cited
Every server’s facts are archived on Zenodo (registry snapshot 2026-10-04) with a DOI, under CC BY 4.0. The How to cite page, live on the site from this date, shows the DOI and a ready citation line for each figure in the reports.
Self-test command published on npm
The date is the npm publish date of protocolprobe-selftest 0.1.0. Operators can run our checks against a server they run themselves, on their own machine; results stay on their machine. ProtocolProbe itself calls no server’s tools. The page for it went live on the site on 2026-10-15.