For MCP server operators
If you found createmcps-validator in your logs: it makes a small number of read-only protocol requests to check your server against the MCP 2026-07-28 specification. It never calls a real tool or reads a real resource. Return 403 to opt out.
What does the createmcps.com validator do?
createmcps.com runs a small number of read-only protocol requests against MCP servers to check conformance with the 2026-07-28 specification. It never calls a real tool, reads a real resource, or gets a real prompt — only reserved sentinel names, per /03-VALIDATOR-RULE-CATALOG.md §5.1.
How do I identify createmcps.com traffic?
User-Agent: createmcps-validator/1.0 (+https://createmcps.com/bot)
Egress IP ranges: not yet published — see /04-PROBE-SANDBOX-DESIGN.md §7 for why (Vercel serverless functions don't have a single static egress IP by default).
How do I stop createmcps.com probing my server?
Return 403 to our User-Agent, or disallow it in robots.txt, and we will not probe your endpoint. To request permanent exclusion, email abuse@createmcps.com — honoured within one business day, no questions asked.
Can I stop a report about my server being public?
Reports are public by default, including ones requested by someone who doesn't own the server. If a report about your server shouldn't be public, tell us and we'll remove it — no account needed. See our disclosure policy.