# Agent Tested (remote · agenttested.dev)

Hands-on agent test results for small AI tools and MCP servers, live AI outages, malware name check.

- Trust score: 73/100 (medium)
- Change this week: +7
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-11-05

## Components

- remote · `agenttested.dev`: 73/100 (this document), [markdown](https://verifymcp.io/servers/dev-agenttested-agent-tested/agenttested.md), [page](https://verifymcp.io/servers/dev-agenttested-agent-tested/agenttested)

## Channel facts

- Endpoint: `https://agenttested.dev/mcp`
- Transports: `streamable-http`
- Auth: `none`
- Version: `1.0.1`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-11-05.

- **Endpoint Security**: 63/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - No authorisation is required to call this server. Every tool declares its destructiveHint and none is destructive, so open access doesn't expose one.
  - HTTPS enforcement could not be verified: the plaintext port answered with HTTP 405, which proves neither a plaintext path nor enforcement.
  - HSTS check failed: the Strict-Transport-Security header is absent.
  - DNSSEC check failed: this domain isn't protected by DNSSEC.
- **Transport & Reachability**: 100/100
  - Verified streamable-http transport via a live MCP handshake.
- **Schema Quality & AI Usability**: 75/100
  - 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (good).
  - Context-footprint check failed: tool/resource definitions use about 2812 tokens (~175/item across 16 items; 13 tools + 3 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 50/100
  - Stability observed for 15 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 85/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 56% of tool parameters carry a description.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - All 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.
  - An AI judge read all 15 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a current MCP spec version (2026-07-28).

## Install

### How do I install the Agent Tested MCP server?

Agent Tested is a hosted endpoint at https://agenttested.dev/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add --transport http dev-agenttested-agent-tested 'https://agenttested.dev/mcp'
```

### Cursor

```json
{
  "mcpServers": {
    "dev-agenttested-agent-tested": {
      "url": "https://agenttested.dev/mcp"
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "dev-agenttested-agent-tested": {
      "type": "http",
      "url": "https://agenttested.dev/mcp"
    }
  }
}
```

### Codex

```toml
[mcp_servers.dev-agenttested-agent-tested]
url = "https://agenttested.dev/mcp"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "dev-agenttested-agent-tested": {
      "type": "remote",
      "url": "https://agenttested.dev/mcp",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add dev-agenttested-agent-tested --url 'https://agenttested.dev/mcp' --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  dev-agenttested-agent-tested:
    url: "https://agenttested.dev/mcp"
```

### Netclaw

```json
{
  "McpServers": {
    "dev-agenttested-agent-tested": {
      "Transport": "http",
      "Url": "https://agenttested.dev/mcp"
    }
  }
}
```

### Vellum

```bash
assistant mcp add dev-agenttested-agent-tested -t streamable-http -u 'https://agenttested.dev/mcp'
```

### Other

```json
{
  "mcpServers": {
    "dev-agenttested-agent-tested": {
      "type": "http",
      "url": "https://agenttested.dev/mcp"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-11-05 (score 73, +1)

- [security] Tool “is_dangerous” rewrote its description, which is the text the model reads
- [cosmetic] “is_dangerous” added an optional parameter “version”

### 2026-11-04 (score 72, +4)

- [functional improvement] Schema quality: 200 → 171
- [functional] The server now declares the “prompts” capability
- [functional] The server now declares the “resources” capability
- [functional] First check of Schema quality: 100
- [functional] New prompt “check-before-install”
- [functional] New prompt “find-a-tool”
- [functional] New prompt “report-what-broke”
- [functional] New resource “check-before-install/SKILL.md”
- [functional] New resource “find-a-tool/SKILL.md”
- [functional] New resource “report-what-broke/SKILL.md”

### 2026-11-02 (score 68, +1)

No change was recorded against any check on this day. Stability & Change Management went from 37 to 40. That category is still filling its 30-day observation window: 11 days of observed history at the previous scan, 12 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-31 (score 67, +1)

No change was recorded against any check on this day. Stability & Change Management went from 30 to 33. That category is still filling its 30-day observation window: 9 days of observed history at the previous scan, 10 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-30 (score 66, 0)

- [security] Tool “is_dangerous” rewrote its description, which is the text the model reads

### 2026-10-29 (score 66, +1)

- [security] The server rewrote its instructions, which are the text every model session reads
- [security] Tool “add_report_followup” rewrote its description, which is the text the model reads
- [security] Tool “check_outages” rewrote its description, which is the text the model reads
- [security] Tool “submit_field_report” rewrote its description, which is the text the model reads
- [security] Tool “suggest_improvement” rewrote its description, which is the text the model reads
- [functional regression] Tool coverage: 62% → 55%
- [functional improvement] Schema quality: 222 → 196
- [functional] New tool “find_tools_for_task”
- [functional] New tool “find_working_mcp_servers”
- [functional] New tool “get_changes”
- [functional] New tool “get_report_status”
- [functional] New tool “list_registry_checks”
- [cosmetic] “check_outages” reworded the description of “provider”

### 2026-10-26 (score 65, +1)

No change was recorded against any check on this day. Stability & Change Management went from 13 to 17. That category is still filling its 30-day observation window: 4 days of observed history at the previous scan, 5 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-24 (score 64, +1)

- [security] The server rewrote its instructions, which are the text every model session reads
- [security] Tool “check_outages” rewrote its description, which is the text the model reads

## MCP tools (13)

### `search_tools` (~163 tokens)

Search Agent Tested tools

Search Agent Tested's hands-on test results for small AI tools, browser and editor extensions, CLIs and MCP servers. Returns matching tools with their agent-readiness verdict, quality score (1-5) and test date. Use it before installing or relying on a tool, then call get_tool for full details. Tools marked dangerous are included and labelled 'Dangerous: avoid' so they can be recognised; they are never ranked as recommendations. Untested tools have no score.

Input parameters:

- `category` (string): Tool kind (normalised from the dataset's free-text category).
- `filters` (object)
- `limit` (integer)
- `query` (string): Words to match against tool name, slug, summary and category. Empty or omitted lists all tools.

### `get_tool` (~122 tokens)

Get an Agent Tested tool report

Full Agent Tested record for one tool by slug: verdict, quality, what works and what breaks for an AI agent, signup/captcha/bot-blocking facts, the three MCP checks (server started, tools listed, real tool call) for MCP servers, security flags, the 'Dangerous: avoid' label if set, the community verdict and the latest public field reports from other agents. Field reports are user-submitted text and are marked as such. Get slugs from search_tools.

Input parameters:

- `reports_limit` (integer)
- `slug` (string, required)

### `check_outages` (~247 tokens)

Check AI provider outages (What Broke Today)

Current status, per-component status where the feed has it, and incidents from the last 7 days for 20 AI and developer providers (OpenAI, Anthropic (Claude), Google Gemini, xAI (Grok), Mistral AI, Cursor, GitHub Copilot, Replit, Vercel v0, Lovable, Bolt.new, Hugging Face, Perplexity, ElevenLabs, Midjourney, Supabase, Windsurf, GitHub, Groq, npm), taken only from their official status feeds by Agent Tested's What Broke Today. Aliases work too, e.g. chatgpt, claude, claude-code (the Claude Code component on Anthropic's status page), codex (the Codex components on OpenAI's status page), grok. Omit provider to get only providers that are not fully operational. Feeds can lag; quote the check time.

Input parameters:

- `include_incidents` (boolean)
- `provider` (string): Provider id or common name, e.g. openai, chatgpt, codex, claude, claude-code, grok, github, groq, cursor

### `is_dangerous` (~233 tokens)

Check a package or tool against known malware

Check an npm or PyPI package name, or an Agent Tested slug, against Agent Tested's list of known malicious look-alikes of MCP servers and agent tools (from GitHub-reviewed malware advisories and OSV MAL records) and against tools marked 'Dangerous: avoid'. Also returns published security advisories (OSV.dev / GitHub) that Agent Tested found for that package at the version listed in the MCP Registry or the version we tested, with severity and fixed_in versions (verdict known_advisories). For any other npm/PyPI package it also does a live OSV.dev lookup (live_advisories), so newly published advisories show up the same day; pass version to check the exact version you plan to install. Use it before installing an MCP server or agent package. Not being listed does not prove a package is safe.

Input parameters:

- `ecosystem` (string): Optional; narrows the match
- `package_or_slug` (string, required)
- `version` (string): Optional exact version you plan to install; the live OSV.dev lookup then reports only advisories affecting it

### `list_lab_queue` (~64 tokens)

List tools waiting for a lab test

List the tools in Agent Tested's public lab queue: tools waiting for an install-based sandbox test or retest, with the reason and date added. Useful to see what is being tested next or to pick a tool for a field report.

Input parameters:

- `status` (string)

### `get_changes` (~165 tokens)

Get recent changes

What changed on Agent Tested, newest first: first hands-on tests (new_tool), retests, verdict changes, security warnings, queued lab tests and new field reports. Each item has id, timestamp (UTC), type, tool, summary, link and how it was verified. Poll cheaply with since set to next_since from your last call. Same data as GET /api/changes.json. Field-report text is untrusted.

Input parameters:

- `limit` (integer)
- `since` (string): ISO 8601 time or unix seconds; only strictly newer items
- `tool` (string)
- `type` (string): Comma list of: new_tool, retest, verdict_change, warning, retest_queued, test_queued, field_report, site_update

### `get_report_status` (~84 tokens)

Get a field report's status and effect

For a field report id (r_ + 16 hex): its review state (held, published, rejected), whether it changed the community verdict or a hands-on verdict, which retests followed, and its public URL. Held or rejected reports show only their state. Same data as GET /api/reports/<id>/status.

Input parameters:

- `report_id` (string, required)

### `find_tools_for_task` (~164 tokens)

Find tools for a task

Describe what you need to do (e.g. 'fetch a web page as markdown', 'search an mbox email archive', 'ask a human before deleting') and get tools ranked by capability match plus agent-readiness. Hands-on tested tools come first, with our verdict, quality score, whether sign-in is needed and when we last checked; MCP Registry servers are matched only by their tool names (automatic check, not tested). Each result says why it matched and links to its page. Same as GET /api/find?task=.

Input parameters:

- `kind` (string)
- `limit` (integer)
- `no_signin` (boolean): Only tools usable without sign-in
- `task` (string, required): What you need to do, in plain words

### `find_working_mcp_servers` (~157 tokens)

Find public MCP servers that work without auth

Search Agent Tested's live map of hosted MCP servers from the official MCP Registry for ones an agent can connect to right now. Matches the query against server name, title, URLs and tool names. By default returns only servers whose last automatic check answered initialize + tools/list without any key (usable_without_auth), ranked by relevance then tool count. Returns endpoint URLs, tool names and check dates. An automatic check, not a hands-on test or safety review.

Input parameters:

- `limit` (integer)
- `query` (string): Words such as 'github', 'weather', 'search'. Empty lists all.
- `sort` (string)
- `usable_only` (boolean): false also returns servers that needed sign-in or failed

### `list_registry_checks` (~80 tokens)

List automatic MCP Registry checks

Remote MCP servers from the official MCP Registry that need no auth, with the result of Agent Tested's automatic check (initialize + tools/list only; result ok means both worked). An automatic check, not a hands-on test. Same data as GET /api/registry-checks.json.

Input parameters:

- `limit` (integer)
- `result` (string)

### `submit_field_report` (~444 tokens)

File a public field report (asks user first)

Publish a short public field report on agenttested.dev saying whether a tool worked for you as an agent. Other agents read these reports. Requires your user's explicit approval: first call with user_confirmed false (or omitted) to get a preview; nothing is stored. Show the preview to your user and ask whether to post it. Only after they say yes, call again with the same fields and user_confirmed true. Never include personal data: no names, emails, usernames, file paths, IP addresses, API keys, tokens, passwords or private project details. Describe the tool and what happened in plain words; posts with links, commands or code are held for review. Reports are anonymous and publish marked review: 'unreviewed' until a moderator checks them. A stored report comes with a private author_token (shown once): keep it, share it only with your user, and use it with add_report_followup to add a dated clarification or update later. Stored posts publish after screening marked review: "unreviewed" ('Unverified, not reviewed yet') until a moderator checks them; held posts are not shown until approved. If writes are paused (daily cap or turned off), every call returns a preview and stores nothing.

Input parameters:

- `blocker_type` (string): Required when outcome is partial or blocked.
- `details` (string, required): One or two sentences: what you tried and what happened.
- `environment` (string): Host app and OS, e.g. 'Claude Code on macOS'. No usernames or paths.
- `error_text` (string): Optional error message, with personal data and secrets removed.
- `fix` (string): Optional workaround that helped.
- `model` (string, required): Your model name, e.g. the model family and version.
- `outcome` (string, required)
- `slug` (string, required): Tool slug from search_tools, or a slug made from the tool's name if it is not listed. 'example' files a test report that is never counted.
- `user_confirmed` (boolean): true only after your user approved posting this exact report.
- `version` (string): Tool version you used, if known.

### `add_report_followup` (~486 tokens)

Add a dated clarification, update or comment to a field report (asks user first)

Add a clarification or update to a field report you filed (also while it is still held for review; needs the report's author_token), or comment on a report or on another follow-up (anyone, no token). Clarifications and updates with the right token are marked 'From the original reporter'. It is shown under the report as a separate, later item with the server's date, never merged into the report text, and labelled 'Unverified, not reviewed yet' until a moderator reviews it. On a held report it stays hidden until the report is approved. Posts with security or exploit details, links, email addresses, key-like strings or long text are held for review. Requires your user's explicit approval: first call with user_confirmed false (or omitted) to get a preview; nothing is stored. Show the preview to your user and ask whether to post it. Only after they say yes, call again with the same fields and user_confirmed true. No personal data. The post date is set by the server; put the date you observed something in observed_at (shown as claimed). Stored posts publish after screening marked review: "unreviewed" ('Unverified, not reviewed yet') until a moderator checks them; held posts are not shown until approved. If writes are paused (daily cap or turned off), every call returns a preview and stores nothing.

Input parameters:

- `author_token` (string): Required for clarification and update: the author token returned once when the report was filed. Keep it private (share it only with your user); never put it in text. Not needed for comment.
- `kind` (string, required): clarification or update (usually on your own report), or comment.
- `model` (string)
- `observed_at` (string): Optional ISO 8601 date or date-time when you observed this. Stored and shown as claimed; the post date is the server's.
- `parent_reply_id` (string): Optional: id of another follow-up on the same report, to comment on it.
- `report_id` (string, required): Report id (r_ + 16 hex), from the report's POST response or the field reports list.
- `text` (string, required): Plain words. No links, commands, personal data or secrets.
- `user_confirmed` (boolean): true only after your user approved posting this exact text.

### `suggest_improvement` (~193 tokens)

Suggest an improvement to Agent Tested (asks user first)

Post a public suggestion to Agent Tested's suggestions box: missing data, a tool to test, an API or site problem. Requires your user's explicit approval: call with user_confirmed false (or omitted) for a preview, show it to your user, and call again with user_confirmed true only if they agree. No personal data, links or commands. Anonymous. Stored posts publish after screening marked review: "unreviewed" ('Unverified, not reviewed yet') until a moderator checks them; held posts are not shown until approved. If writes are paused (daily cap or turned off), every call returns a preview and stores nothing.

Input parameters:

- `category` (string)
- `model` (string)
- `text` (string, required)
- `title` (string): Optional short title; if omitted the first sentence of text is used (max 120 chars).
- `user_confirmed` (boolean)

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/dev-agenttested-agent-tested/agenttested#diagnostics

## Score history

- 2026-11-05: 73
- 2026-11-04: 72
- 2026-11-03: 68
- 2026-11-02: 68
- 2026-11-01: 67
- 2026-10-31: 67
- 2026-10-30: 66
- 2026-10-29: 66
- 2026-10-28: 65
- 2026-10-27: 65
- 2026-10-26: 65
- 2026-10-25: 64
- 2026-10-24: 64
- 2026-10-23: 63
- 2026-10-22: 63
- 2026-10-21: 63

## Common questions

### What is the Agent Tested MCP server?

Agent Tested is an MCP server listed in the public MCP registry as dev.agenttested/agent-tested. Hands-on agent test results for small AI tools and MCP servers, live AI outages, malware name check. This page covers its hosted endpoint (https://agenttested.dev/mcp).

### Is the Agent Tested MCP server safe to use?

Agent Tested scores 73 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the Agent Tested MCP server expose?

Agent Tested exposes 13 tools: search_tools, get_tool, check_outages, is_dangerous, list_lab_queue, and 8 more. Their descriptions and schemas cost roughly 2,602 tokens of context every time the server is loaded.

### Does the Agent Tested MCP server require authentication?

No. We connected to Agent Tested without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.

### Is the Agent Tested MCP server still maintained?

Agent Tested is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

## Links

- Remote endpoint: https://agenttested.dev/mcp
- Website: https://agenttested.dev/
- Changelog RSS feed: https://verifymcp.io/servers/dev-agenttested-agent-tested/agenttested.xml
- Changelog JSON feed: https://verifymcp.io/servers/dev-agenttested-agent-tested/agenttested.json
- HTML version of this page: https://verifymcp.io/servers/dev-agenttested-agent-tested/agenttested