mcpbeat Sign in

Preflight MCP Server

by allthepossibles Your server? Claim it
answering

Preflight is answering right now. Last checked 11 min ago. It exposes 4 tools.

Scans an MCP server for security gaps before your agent connects. Free tier, no signup.

Uptime history 7 days of history
7 days agonow
100.0%
Uptime 24h
91 of 91 checks
4
Tools
read from the server
202 ms
Response time
average over 24h
open, no key
Access
streamable-http

Nothing serious here today

Today is the operative word: we check Preflight every 15 minutes and re-read its code on every release. Watch it and you find out the day that stops being true.

Three servers free · no card

Connect this server

Endpoint below is the one we actually reach during checks — not the one copied from a README. Last verified 11 min ago.

run in your terminal
claude mcp add preflight --transport http https://preflight.allthepossibles.com/mcp
Settings → Connectors → Add custom connector, then paste this address
https://preflight.allthepossibles.com/mcp
~/.codex/config.toml
[mcp_servers.preflight]
url = "https://preflight.allthepossibles.com/mcp"
.cursor/mcp.json
{
  "mcpServers": {
    "preflight": {
      "url": "https://preflight.allthepossibles.com/mcp"
    }
  }
}
.vscode/mcp.json
{
  "servers": {
    "preflight": {
      "type": "http",
      "url": "https://preflight.allthepossibles.com/mcp"
    }
  }
}

Available tools 4

Read directly from the server with tools/list, grouped by what they act on. If a tool disappears, we record the date.

scan
scan_content
Check a document or web page for hidden instructions before an agent reads, summarizes, or acts on it: invisible Unicode, obfuscated payloads, and (on Pro) a semantic pass for prompt-injection phrasing aimed at the model instead of the human reader. Pass either a URL to fetch, or raw text you already have.
scan_extension
Check a VS Code extension or a Claude Skill before installing or trusting it. For a VS Code extension (which runs with full Node.js access and no permission model to scope): publisher domain-verification status weighed against install count, and known-bad-signature checks on its description. For a Claude Skill: hidden-instruction and obfuscated-payload detection on the SKILL.md body (the same engine scan_content uses), unscoped or credential-referencing tool grants in its allowed-tools/disallowed-tools frontmatter, inline shell execution baked into the file itself, and pattern matching on any bundled script files for credential-exfiltration signatures. Semantic prompt-injection detection on a skill's body runs too on Pro.
scan_mcp_server
Check an MCP server for real risk signals before trusting it: unauthenticated transport, capability overreach (filesystem/shell/credential access with no scoping), and known-bad signatures. Pass a live server URL, or a manifest of tool definitions if the server isn't reachable over HTTP. Semantic prompt-injection detection runs too if a Pro API key is sent as an Authorization: Bearer header, see /docs.
output
check_output
Check a structured output you're about to return or act on for degenerate-answer patterns a schema check can't see: invalid JSON, a placeholder value ('TBD', 'N/A', 'unknown') where a real answer should be, an array of byte-identical items (a common symptom of a loop that never advanced), or an expected field that's missing or empty. Schema validity and answer quality are different guarantees, call this before trusting your own output, not just after validating it parses.

Endpoints

URLTransportStateLatencyChecked
https://preflight.allthepossibles.com/mcp streamable-http answering 116 ms 11 min ago

Alternatives to Preflight

same job, measured the same way
Kadent Scan
by kadent

Free, read-only security scanner for remote MCP servers, before you connect them.

1 tools answering
Aguara MCP
by garagon

Security scanner for AI agent skills and MCP servers

local only
Mund — MCP Security Scanner
by tyox-all

Scan for prompt injection, secrets, PII, and vet MCP servers before installation

55 installs/wk local only
Prism Scanner
by aidongise-cell

Security scanner for AI Agent skills, plugins, and MCP servers with A-F grading.

154 installs/wk local only
Universal Connector MCP
by teodormcp

Security-first MCP server that connects any OpenAPI, GraphQL, gRPC or SOAP API to AI agents.

187 installs/wk local only
Bawbel Scanner
by bawbel

Security scanner for MCP servers and skill files. Detects AVE vulnerabilities before production.

214 installs/wk local only
Bawbel Scanner
by bawbel

Security scanner for MCP servers and skill files. Detects AVE vulnerabilities before production.

local only
CrowdStrike Falcon MCP Server
by crowdstrike

Connects AI agents with CrowdStrike Falcon for security analysis and automation.

24 401 installs/wk local only

Preflight — questions

Answers built from our own checks of this server.

What can Preflight do?
It exposes 4 tools, read directly from the server on our last check. Among them: check_output, scan_content, scan_extension, scan_mcp_server. The full list with descriptions is on this page — we take it from the server itself via tools/list, not from a README. How MCP servers expose tools in the first place →
Is Preflight working right now?
We send a real MCP handshake every 15 minutes. Over the last 24 hours 91 of 91 checks got a reply (100.0%), average response time 202 ms. The bar chart above shows every period we have measured.
How do I connect Preflight?
Copy the ready config from this page. We generate it for Claude Code, Claude Desktop, Codex, Cursor and VS Code, each in the form that client actually reads. It is a remote server, so there is nothing to install — the client connects to the address.
Does Preflight need an API key?
No. Preflight completed a full MCP handshake with us as an anonymous client and listed its tools without asking for anything. All 4 of them are readable on this page. This is what we observed, not what the docs claim.
How fast is Preflight?
It answers our handshake in 202 ms on average, which is faster than 78% of all working MCP servers we measure. That puts it in the quick quarter of the ecosystem. The comparison comes from our own checks across the whole registry, every 15 minutes.