> ## Documentation Index
> Fetch the complete documentation index at: https://docs.mcpmanager.ai/llms.txt
> Use this file to discover all available pages before exploring further.
# Validate MCP Servers with Open Tools
> Confirm an MCP server connects and behaves correctly using free, open-source inspectors that run on your own machine — the official MCP Inspector and MCPJam. Both speak the raw protocol and need no LLM to validate connectivity and list a server's tools, resources, and prompts. Validate connectivity and correctness here first, so your time in MCP Manager goes to governance rather than diagnosing connections.
Most MCP servers connect in just a few minutes. The ones that take longer usually aren't hard so much as particular — as the [server guides](/mcp-server-guides/overview) show, one server wants a scoped token, another a region-specific URL or an admin-allowlisted callback, and a few, like the [AWS MCP Server](/mcp-server-guides/aws), run through a local signing proxy. Whichever you're connecting, it helps to confirm it works on its own first, and that's exactly what these tools are for.
Two free, open-source **inspectors** are purpose-built to help teams building or using MCP servers validate **connectivity and correctness**: the **official MCP Inspector** and **MCPJam**. Both run on your own machine, speak the raw MCP protocol, and need **no LLM** to connect to a server and list what it offers. Use one to confirm a server is sound *before* you bring it into MCP Manager — so the time you spend in MCP Manager goes to what it's for, **governance** (rules, identity, logging, and access), instead of diagnosing connections.
Both tools are independent open-source projects, not part of MCP Manager. Their own documentation is authoritative and may be more current than this
page. We point to them because they're the fastest, most neutral way to verify a server in isolation.
## Which tool should I use?
Either works for the core job — connect to a server and inspect its tools, resources, and prompts. They differ in focus:
| | **Official MCP Inspector** | **MCPJam** |
| :------------------- | :----------------------------------------------------------- | :----------------------------------------------------------------------------------- |
| Maintainer · license | The MCP project (Anthropic) · MIT | MCPJam · Apache 2.0 |
| How to run | `npx @modelcontextprotocol/inspector` (local only) | Hosted at `app.mcpjam.com`, `npx @mcpjam/inspector@latest`, or a desktop app |
| Strongest at | The neutral reference tool; a scriptable `--cli` mode for CI | Guided **OAuth debugging**; sharing a live server with teammates |
| OAuth | Bearer token / custom headers, plus an OAuth flow | A step-by-step **OAuth Debugger** across spec versions (DCR, pre-registration, CIMD) |
| Shareable / hosted | No — runs locally | Yes — a hosted web app and shareable links |
| Needs an LLM? | Never | Only for its optional chat/eval features |
* **Choose the official MCP Inspector** when you want the canonical reference implementation, everything strictly local, or a `--cli` mode you can wire into CI.
* **Choose MCPJam** when OAuth is the hard part (its OAuth Debugger is the standout), when you want to share a running server with teammates, or when you may later go beyond connectivity into model-driven chat and evals.
You don't have to pick one forever — both install in seconds, so it's fine to reach for whichever fits the problem in front of you.
## The official MCP Inspector
The [MCP Inspector](https://github.com/modelcontextprotocol/inspector) is the reference testing tool maintained by the Model Context Protocol project (MIT-licensed). It has two parts: a **React UI** (the *MCP Inspector Client*, default port **6274**) and a **proxy** (the *MCP Proxy*, default port **6277**) that bridges the browser to the server's transport. Both bind to `localhost` only.
### Run it
```bash theme={null}
# UI mode — opens the inspector in your browser
npx @modelcontextprotocol/inspector
```
It prints a URL that includes a **proxy session token**; open that exact link. (The token protects the proxy from other processes on your machine — see [Security](#security-notes).)
You can also point it straight at a local/STDIO server:
```bash npm package server theme={null}
npx -y @modelcontextprotocol/inspector npx @modelcontextprotocol/server-filesystem /path/to/dir
```
```bash PyPI package server theme={null}
npx @modelcontextprotocol/inspector uvx mcp-server-git --repository ~/code/repo
```
```bash local build theme={null}
npx @modelcontextprotocol/inspector node build/index.js arg1 arg2
```
Pass environment variables with `-e key=value`, and change ports with `CLIENT_PORT=8080 SERVER_PORT=9000`.
### Connect to a remote server
Run `npx @modelcontextprotocol/inspector` with no command, then in the **Server connection** pane choose the transport — **Streamable HTTP** for most current servers (or **SSE** for older ones) — and paste the server's URL. For an authenticated server, enter a **Bearer token** (sent in the `Authorization` header; you can override the header name) or add custom headers. The Inspector runs the same `initialize` handshake and capability negotiation any MCP client does.
### Inspect what the server offers
The UI has panes for **Resources**, **Prompts**, **Tools**, and **Notifications**. List each, read the schemas, call a tool with custom inputs, and watch every JSON-RPC message and server log in the Notifications pane.
### CLI mode (for scripting and CI)
`--cli` runs the same checks headlessly — ideal for a CI gate:
```bash theme={null}
# List a remote server's tools over Streamable HTTP
npx @modelcontextprotocol/inspector --cli https://mcp.example.com --transport http --method tools/list
# Call a tool
npx @modelcontextprotocol/inspector --cli https://mcp.example.com --transport http \
--method tools/call --tool-name search --tool-arg query=hello
# Send a custom auth header
npx @modelcontextprotocol/inspector --cli https://mcp.example.com --header "Authorization: Bearer " --method tools/list
```
### Security notes
The Inspector hardened its defaults after [CVE-2025-49596](https://github.com/modelcontextprotocol/inspector/security/advisories) (a remote-code-execution risk):
* The proxy requires a **session token** (auto-generated, printed on startup, or set via `MCP_PROXY_AUTH_TOKEN`). Use the printed link so the token is included.
* Both the UI and proxy **bind to `localhost`** by default, with `Origin`-header (DNS-rebinding) validation.
* Don't set `DANGEROUSLY_OMIT_AUTH` — disabling the token can let a malicious web page reach the proxy and run commands on your machine.
## MCPJam
[MCPJam](https://www.mcpjam.com/) is an open-source (Apache 2.0) MCP development platform. For validation its standout is a guided **OAuth Debugger**, which is exactly what you want for the auth-heavy servers in the [server guides](/mcp-server-guides/overview).
### Run it
| Option | How | Notes |
| :-------------------------------------------- | :---------------------------------------------------------------------------- | :----------------------------------------------------------------------------------------------------------- |
| **Hosted** (fastest) | Open [app.mcpjam.com](https://app.mcpjam.com/) | No install. **HTTPS server URLs only**; no local/STDIO. |
| **Terminal** (best for sensitive credentials) | `npx @mcpjam/inspector@latest` | Node.js 20+. Opens at `http://localhost:6274`. HTTP/S **and** local STDIO. Everything stays on your machine. |
| **Desktop** (Mac/Windows) | [Download the installer](https://github.com/MCPJam/inspector/releases/latest) | No Node.js required. HTTP/S and local STDIO. |
### Connect and inspect
Click **Add server**, enter the server's URL, and choose its authentication — **None**, **Bearer Token**, or **OAuth 2.0**. Once connected, browse **Tools**, **Resources**, and **Prompts**, and run a tool by hand with full JSON-RPC visibility.
### Debug OAuth
For an OAuth server, MCPJam's **OAuth Debugger** walks each stage of the handshake — discovery, Dynamic Client Registration, client pre-registration, the authorize redirect, and token exchange — and shows where it breaks. This is the fastest way to pin down problems like a callback domain an admin hasn't allowlisted, or a [self-hosted server's DCR](/build-your-own-mcp-server/debugging-self-hosted-oauth) failing.
For a real server with **sensitive credentials**, prefer MCPJam's **terminal** (`npx`) or **desktop** app — the connection and any tokens stay on
your machine. The hosted app is great for a quick check of a public HTTPS endpoint; note it stores any OAuth tokens you connect in its own vault,
and its optional AI chat (the only LLM-using feature) is gated behind usage credits.
## Validate, then govern
Whichever tool you use, the validation loop is the same — and none of it touches an LLM:
Start the official Inspector (`npx @modelcontextprotocol/inspector`) or MCPJam (`npx @mcpjam/inspector@latest`) and open the printed link.
Use the identical endpoint and credentials. You're testing the exact thing you intend to connect, so the result transfers directly.
A clean `initialize` and capability negotiation means the server and your credentials are sound. A failure here is a server- or credential-side
issue to fix at the source.
List tools, resources, and prompts, and call a tool to confirm it actually responds. If it's an OAuth server, step through the handshake (MCPJam's
OAuth Debugger is ideal).
Once the server checks out, add it in MCP Manager using the matching [server guide](/mcp-server-guides/overview) — and spend your time there on
what MCP Manager is for: rules, identity, logging, and access. Connectivity is already settled.
### Audit what a gateway exposes
The same inspectors work in reverse. Point one at an **MCP Manager gateway URL** (with its credential) and list its tools to confirm exactly what that gateway serves to clients — a quick way to verify a gateway's surface after you've assigned servers and applied rules.
## Gotchas & things to keep in mind
* **Both UIs default to port `6274`.** To run them at the same time, move one — `CLIENT_PORT`/`SERVER_PORT` for the official Inspector, `--port` for MCPJam.
* **Use the official Inspector's printed link.** It carries the proxy session token; opening a bare `localhost:6274` without it won't authenticate. Never set `DANGEROUSLY_OMIT_AUTH`.
* **MCPJam's hosted app is HTTPS-only and has no STDIO.** For an HTTP endpoint, a local/STDIO server, or sensitive credentials, use a locally-run inspector instead.
* **These tools validate connectivity, not governance.** They confirm a server works and show its capabilities; the inspection, identity, logging, and rules that make traffic *safe* are what MCP Manager adds on top.
* **They're independent projects.** Their UIs and flags change; if a step here has drifted, their own docs are authoritative.
## Further reading
How MCP Manager detects a server's authentication type, and the per-server connection guides.
A good example of a connection worth validating first — IAM SigV4 via a locally-run proxy.
An OAuth server where an OAuth debugger helps — including the admin callback-domain allowlist.
When you're building the server yourself and the OAuth handshake is the problem.
## External sources
The official, MIT-licensed reference inspector — source, releases, and the security model.
The Model Context Protocol project's guide to the Inspector's panes and workflow.
Open MCPJam in your browser; no install required (HTTPS servers only).
The open-source (Apache 2.0) MCPJam project — source, installation, and releases.