MCP Config Validator
RUNS LOCALLYCheck a Model Context Protocol configuration before wiring it into a client. The validator catches the mistakes that break a config in practice rather than only checking the JSON parses: missing transports, relative command paths, malformed arguments and credentials committed as literal values.
Your tool input is processed locally in your browser and is not intentionally uploaded to our servers. Advertising and analytics providers may still process normal page, device, cookie and network information.
How to use it
- Paste the contents of your MCP configuration file, whichever client it belongs to.
- Press Validate. The tool never launches, connects to or executes any server it finds.
- Fix the errors first — those stop the config working at all — then review the warnings.
- Download the report if you need to share it. Secret-shaped values are masked in the download.
A worked example
The example declares two servers. The first is a correct stdio server invoked through npx. The second uses a relative command path and references an environment variable with shell-style syntax.
Both problems are warnings rather than errors, because the file is valid JSON and structurally correct — yet neither server would start. That is the gap this tool exists to close: a config can parse perfectly and still fail at launch.
Press Example in the workspace above to load it.
Questions
Why does my MCP server not connect even though the config is valid JSON?
The most common causes are a relative command path, a command that is not on PATH in the environment the client launches from, and an environment variable written as ${VAR} that the client passes through literally rather than expanding. All three produce valid JSON and a server that never starts. The validator flags each one.
Does this tool run or connect to my MCP servers?
No. It reads the configuration as text and never executes a command, opens a connection or launches a process. That is a deliberate limit: a configuration file can name any executable on your machine, and running one to check a config would be a considerably worse idea than reading it.
What happens if my config contains a real API key?
The value is flagged as a warning, masked in any report you download, and advertising is suppressed on this page for as long as a secret-shaped value is present. If a key has been committed anywhere, the safest response is to rotate it rather than remove it — the old value remains valid until revoked.
Should I use mcpServers or servers as the top-level key?
Most clients expect mcpServers. The validator accepts servers but warns, because a config using the wrong key silently loads no servers at all — the client finds nothing and reports nothing. Check your client documentation if you are unsure, since this is one of the few places clients genuinely differ.
Does my input leave the browser?
No. Your tool input is processed locally in your browser and is not intentionally uploaded to our servers. Advertising and analytics providers may still process normal page, device, cookie and network information. Nothing you paste is logged, stored or sent to an analytics event, and there is no account to attach it to.