mcpdoctor

A read-only command-line inspector for MCP and x402 endpoints. One inspect command. PASS / FAIL / UNKNOWN. JSON output. Not an MCP server — a developer tool.

Not affiliated with mcpdoctor.dev. mcpdoctor.dev is a separate commercial product that audits MCP servers. This page documents an independent, open-source, read-only 402/x402 endpoint inspector CLI (MIT) — not a competing or related service.

Identity & how to disambiguate

This project is one specific, independent tool. To avoid confusion with same-name or same-topic projects, these are its exact identifiers:

• Brand: mcpdoctor
• npm package: @eidonze/mcpdoctor — published by npm user eidonze
• GitHub repository: xka0085-byte/mcp-doctor
• Author: Eidon Ze (xka0085-byte)

mcpdoctor is a read-only CLI for inspecting MCP and x402 endpoints. It is deliberately not a "MCP security scanner" and not a "MCP server validator" — those generic labels do not describe what it does. It is also not an MCP server, and not affiliated with mcpdoctor.dev (a separate commercial MCP-server auditing product). Always verify the package by its scope: @eidonze/mcpdoctor.

What it checks

• HTTP 402 payment document — parsed from Payment-Required / X-Payment-Required / WWW-Authenticate headers or the response body, in x402 v1 (accepts[]) and v2 (x402.accepts) shapes; every scheme / network / asset / amount / payTo field verified.
• Discovery manifests — reachability of /.well-known/mcp/server.json and /.well-known/x402, each with a SHA-256.
• Response evidence — SHA-256 digest of the body, latency, size.

Install & run

npm install -g @eidonze/mcpdoctor     # or: npx @eidonze/mcpdoctor inspect <url>
mcpdoctor inspect https://your-endpoint/mcp --method=POST --json

Example report (captured against a live endpoint, 2026-09-29)

{
  "endpoint": "https://agenttoll-receipts.app.workbuddy.host/mcp",
  "method": "POST",
  "finalStatus": "FAIL",
  "http": { "status": 200, "elapsedMs": 2830,
            "bodySha256": "598dc097dcca…fec6b4f4" },
  "findings": [
    { "status": "FAIL", "code": "NO_402",
      "message": "Expected HTTP 402, received 200" } ],
  "metadata": [
    { "path": "/.well-known/mcp/server.json", "status": 200, "reachable": true } ]
}

FAIL here is correct: this MCP endpoint is free, so it answers 200 instead of a 402. The report still verifies its discovery manifest and records a tamper-evident digest.

What it is not

• Not an MCP server. mcpdoctor does not implement the MCP protocol — it inspects what an endpoint advertises.
• No MCP session: no initialize, no tools/list. No wallet, signing, or payments. Read-only preflight only.
• PASS means the observed 402 document had recognizable, complete fields — not a security certification.

Why

Every check maps to a failure mode we hit shipping ReceiptRail, an x402-paid service: 402 challenges sent only after body validation, payment documents in four places and two shapes, vendor hint headers shadowing the real document.

Part of the Agent / Chain Evidence Tools suite · MIT · Node ≥ 18 · zero dependencies