Probe, connect and debug MCP servers.

Quickstart

1. Open the probe and paste the URL of a server that speaks MCP over Streamable HTTP, for example https://mcp.deepwiki.com/mcp. The https:// prefix is added if you leave it out.
2. Press Probe. Moonpeak detects the protocol era (2026-07-28 or an older handshake revision), lists everything the server exposes and shows two scores, protocol and security, with the reason behind each point lost.
3. Open a tool to get a form generated from its input schema. Press Run to call it. If the tool links an MCP App, its UI renders under the result.
4. Export the report as Markdown or JSON, or copy its share link.

Deep links

Any probe can be opened directly. The page starts probing as soon as it loads:

https://moonpeak.dev/?url=https%3A%2F%2Fmcp.deepwiki.com%2Fmcp

Servers behind a token

Choose Add a bearer token under the URL field. The token is sent as Authorization: Bearer … to the server you named, on each request, and is never stored. Full OAuth sign-in flows are not supported yet.

Connect the Moonpeak server

Moonpeak's own server is public, stateless and read-only. Its endpoint is:

https://moonpeak.dev/api/mcp

{
  "mcpServers": {
    "moonpeak": {
      "type": "http",
      "url": "https://moonpeak.dev/api/mcp"
    }
  }
}

Tool reference

All three tools are read-only and declare readOnlyHint: true. Each returns a short text summary and the same data as structuredContent, described by an output schema.

chain_status

Latest block, block age, gas price and chain ID of mainnet Chain 4663, read live from a public node. Takes no arguments.

{
  "chainId": 4663,
  "block": 108349031,
  "blockTime": "2026-11-07T10:46:41.000Z",
  "blockAgeSeconds": 1,
  "gasPriceGwei": "0.020054"
}

token_lookup

Reads an ERC-20 contract: name, symbol, decimals and total supply, plus one holder balance if asked. Links the ui://moonpeak/token-card.html MCP App.

{
  "address": "0x39dbed3a2bd333467115de45665cc57f813c4571",
  "name": "Pons",
  "symbol": "PONS",
  "decimals": 18,
  "totalSupply": "1,000,000,000",
  "holderBalance": "0",
  "block": 108349031
}

Errors come back as a normal result with isError: true, for example "No contract at 0x…0001 on Chain 4663." or "… is a contract but does not answer as an ERC-20 token."

moon_phase

Approximate moon phase and illumination for a UTC date. Defaults to today. Invalid dates such as 2026-02-30 are rejected.

{
  "date": "2026-11-24",
  "phase": "Full moon",
  "illumination": 1,
  "ageDays": 14.6,
  "nextFullMoon": "2026-12-24"
}

Raw protocol

The Moonpeak server speaks both protocol eras. In MCP 2026-07-28 there is no handshake: every request carries its version and client details in _meta, and the method in an Mcp-Method header that must match the body.

1. Discover the server (2026-07-28)

curl -s https://moonpeak.dev/api/mcp \
  -H 'content-type: application/json' \
  -H 'accept: application/json, text/event-stream' \
  -H 'MCP-Protocol-Version: 2026-07-28' \
  -H 'Mcp-Method: server/discover' \
  -d '{"jsonrpc":"2.0","id":1,"method":"server/discover","params":{"_meta":{"io.modelcontextprotocol/protocolVersion":"2026-07-28","io.modelcontextprotocol/clientInfo":{"name":"curl","version":"1"},"io.modelcontextprotocol/clientCapabilities":{}}}}'

2. Call a tool (2026-07-28)

tools/call, resources/read and prompts/get also need an Mcp-Name header.

curl -s https://moonpeak.dev/api/mcp \
  -H 'content-type: application/json' \
  -H 'MCP-Protocol-Version: 2026-07-28' \
  -H 'Mcp-Method: tools/call' \
  -H 'Mcp-Name: moon_phase' \
  -d '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"moon_phase","arguments":{"date":"2026-11-24"},"_meta":{"io.modelcontextprotocol/protocolVersion":"2026-07-28","io.modelcontextprotocol/clientInfo":{"name":"curl","version":"1"},"io.modelcontextprotocol/clientCapabilities":{}}}}'

Every result carries resultType; discovery, lists and reads add ttlMs and cacheScope. A header that contradicts the body gets 400 with error -32020, an unknown version gets 400 with -32022 and the supported list, an unknown method gets 404 with -32601.

3. Legacy clients

Clients that start with initialize (2025-11-25 and earlier) still work, without sessions:

curl -s https://moonpeak.dev/api/mcp \
  -H 'content-type: application/json' \
  -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-11-25","capabilities":{},"clientInfo":{"name":"curl","version":"1"}}}'

Score API and badges

GET /api/score runs the full probe from Moonpeak's servers, with the same engine as the site, and returns the report as JSON.

It answers 200 when every threshold passes and 422 when one fails, with the reasons in failures. Unreachable servers get 502 with an error. An Authorization header is forwarded to the probed server only, and such responses are never cached.

curl -sS --fail-with-body \
  "https://moonpeak.dev/api/score?url=https%3A%2F%2Fmoonpeak.dev%2Fapi%2Fmcp&min=85&securityMin=85"

{
  "ok": true,
  "pass": true,
  "failures": [],
  "era": "modern",
  "protocolVersion": "2026-07-28",
  "score": 100,
  "securityScore": 100,
  "fingerprint": "755ffb801c321249e475f6d4ebb9b2f0aec23ff066ecb9ea6f97b45f1d8f313b",
  "checks": [ … ],
  "security": [ … ],
  "report": "https://moonpeak.dev/?url=…#probe"
}

Badges

GET /api/badge?url=… returns an SVG badge with the protocol score; add &type=security for the security score. Badges are cached for an hour.

[![MCP score](https://moonpeak.dev/api/badge?url=https%3A%2F%2Fmcp.example.com%2Fmcp)](https://moonpeak.dev/?url=https%3A%2F%2Fmcp.example.com%2Fmcp)

MCP Apps host

When a tool's _meta.ui.resourceUri (or openai/outputTemplate) points to a resource, Moonpeak reads it with resources/read, checks that it is HTML and renders it in an iframe sandboxed with allow-scripts allow-forms only. The preview host supports:

Apps that never send initialized still receive their data 1.5 s after loading. Apps built for the Apps SDK get a window.openai object with toolInput, toolOutput, callTool, openExternal and sendFollowUpMessage.

Relay API

POST /api/relay forwards one JSON-RPC message to a public MCP server and returns what came back. It is what the probe uses, and you can call it too.

curl -s https://moonpeak.dev/api/relay \
  -H 'content-type: application/json' \
  -d '{"url":"https://mcp.deepwiki.com/mcp","message":{"jsonrpc":"2.0","id":1,"method":"ping"}}'

Limits and errors