An HTTP 200 confirms that an HTTP request received a successful status; it does not prove that a remote Model Context Protocol (MCP) server accepted a valid MCP request, returned a usable JSON-RPC response, completed an SSE stream, authorized the client, or performed a healthy application operation. A reliable check validates those layers separately, using the same access path and credentials as a real client.
What a useful MCP health check needs to prove
Think of health as a set of distinct signals, not a single green HTTP status. A check can succeed at one layer and fail at the next:
As an Amazon Associate I earn from qualifying purchases.
- Network and TLS: the configured production hostname resolves, a connection is established, and TLS completes.
- HTTP: the endpoint returns an HTTP response. Record the status, but do not treat it as proof that MCP worked.
- MCP and JSON-RPC: the server accepts a valid request and returns a well-formed response correlated to that request.
- Authorization: the probe is accepted under the same authentication and Origin controls intended for clients.
- Application health: a safe operation returns its documented healthy result, if the service provides one.
Report these separately, along with latency where useful. That distinguishes a TLS outage from an authorization failure, protocol error, broken stream, or unhealthy downstream dependency.
How to probe a remote MCP server
1. Check the production network path
Connect to the configured MCP URL using the production DNS name, TLS settings, and expected network route. Record DNS resolution, connection, TLS, timeout, and HTTP outcomes independently. A generic /health URL only proves MCP health if that route is explicitly part of the service’s health contract.
#1 Best Overall
- More for the money with this high quality Product
- Offers premium quality at outstanding saving
- Excellent product
- 100% satisfaction
2. Send a valid, authorized MCP request
For the dated 2026-07-28 Streamable HTTP specification, MCP requests are JSON-RPC messages sent by POST to one MCP endpoint. Send one JSON-RPC request per POST and include Accept: application/json, text/event-stream. Include the required protocol-version metadata, and keep the MCP-Protocol-Version header consistent with the version in the message body; unsupported versions or mismatches can cause rejection even when the endpoint is reachable.
Use the authentication mechanism expected of production clients and an Origin acceptable to the deployment. The specification says servers MUST validate the Origin header on incoming connections to prevent DNS rebinding attacks; an invalid supplied Origin must receive HTTP 403. It recommends proper authentication as well. A probe that omits these controls may mistake an access denial for a service outage. Use limited probe credentials rather than disabling security checks.
Rank #2
- Device Supported: Server Chassis
- Compatibility: Supermicro Server Chassis: SuperChassis 101F SuperServer E200-8D
3. Validate the entire response
The request can receive either a JSON object or a request-scoped SSE stream. For JSON, parse the body and check that it has a valid JSON-RPC envelope, the response ID matches the request ID, and the result is what the probe expects. An HTTP success with malformed JSON, a JSON-RPC error, an unexpected result, or a mismatched ID is not a successful MCP check.
For SSE, parse events until the request’s final JSON-RPC response arrives or a defined deadline expires. Intermediate notifications may arrive before the response. Treat a stream that opens but never produces the expected final response, closes prematurely, or contains malformed events as a failure. Reverse-proxy buffering can delay events; the specification recommends X-Accel-Buffering: no to prevent proxies from accumulating them. It also encourages comment-line keep-alives for long-lived streams. A routine probe should be short and bounded; subscriptions need a different monitoring and timeout policy.
4. Check application health safely
A tools/list request can show that the endpoint handles an MCP operation and returns a tools result, but it does not establish that every downstream dependency is healthy. If the server provides a purpose-built health tool, invoke it and validate its documented status fields. Otherwise, choose a low-risk representative operation and state what it actually verifies.
A Google Cloud Cloud Run codelab illustrates this pattern: it lists available tools, then invokes a gcp_resource_health_checker tool whose example result includes status and deployment metadata. That name and schema belong to the example; MCP does not require every server to expose that tool. Avoid destructive calls, expensive repeated work, or checks whose side effects could alter production data.
Choose probe depth to match the question
| Probe | What it establishes | What it does not establish | Trade-off |
|---|---|---|---|
| Network and TLS only | The configured endpoint is reachable over the expected route and can complete TLS. | That MCP accepts requests, authorization succeeds, or an application operation works. | Low-cost and useful for connectivity diagnosis, but shallow. |
Valid MCP request, such as tools/list |
The endpoint accepts an MCP request and returns a correlated protocol response. | That listed tools or their downstream dependencies are healthy. | More meaningful than a bare HTTP check; requires protocol-aware response handling. |
| MCP request plus safe application health operation | The protocol path works and the specific operation’s documented health conditions pass. | Components or dependencies the operation does not exercise. | Greater diagnostic depth, potentially with extra resource use or downstream load. |
Whichever depth you choose, preserve production access fidelity: authentication and Origin handling should match the real client path. For SSE responses, success means receiving and validating the final response, not merely opening a stream.
Free tools Windows power users keep installed
One-click scans. No signup required.
Match the probe to the deployed protocol version
The current dated transport rules in the 2026-07-28 specification differ from earlier MCP HTTP transport behavior. The MCP maintainers’ May 21, 2026 article explains that this revision removes the initialize/initialized handshake and protocol-level Mcp-Session-Id; protocol version and client metadata are carried with requests. It also documents Mcp-Method and Mcp-Name routing headers.
The earlier 2025-11-25 transport page describes a different shape, including sessions and a standalone GET stream. Treat it as compatibility guidance for older deployments, not as the current 2026-07-28 procedure. If your environment has mixed server versions, use version-specific probe profiles and label which profile passed. Confirm the deployed server’s version and health contract rather than assuming every server has upgraded or that all SDKs behave identically.
Make failures actionable
Keep the results of each layer visible in monitoring rather than compressing them into one “up” check. A useful report can include endpoint/TLS reachability, HTTP status, authentication outcome, MCP request acceptance, JSON-RPC validity, application-operation status, and latency. This helps an operator see whether to investigate networking, credentials, protocol compatibility, stream handling, or a dependency.
No single successful probe proves every server feature or dependency is healthy. Name the operation checked and its scope so that a passing result is not mistaken for broader coverage.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
