CLI

How do I run the CLI?

npx createmcps validate https://mcp.example.com/mcp

npx createmcps validate https://mcp.example.com/mcp --format json

npx createmcps validate ./server.json --offline

How do I check MCP compliance in CI?

This is the habit-forming part — a compliance regression fails the build the same way a broken test would.

name: MCP Compliance

on: [push, pull_request]

jobs:
  validate:
    runs-on: ubuntu-latest
    steps:
      - name: Validate MCP server
        run: npx createmcps validate https://mcp.example.com/mcp

To see each failing rule as an annotation on the pull request, run with --format sarif and upload the file with GitHub's upload-sarif action. A fail maps to a SARIF error and a warn to a warning.

What do the CLI exit codes mean?

• 0No failures at or above --fail-on — safe to pass a CI gate
• 1One or more rule failures
• 2No verdict — target unreachable, refused, or nothing could be checked
• 3Usage error, or the validator itself could not run (not a finding)

A server we couldn't reach is exit 2, not 1 — a CI gate can tell “your server broke a rule” apart from “we couldn't reach your server at all.” And a crash in our checker is exit 3, never 0, so a build can't go green because the validator fell over.

What options does it take?

• --format <text|json|sarif>

  Output format (default text). sarif uploads to GitHub code scanning.

• --fail-on <fail|warn|never>

  When to exit non-zero (default fail).

• --offline

  Check a local server.json's structure only. Sends nothing anywhere.

• --api <url>

  Validate through a different deployment (default https://createmcps.com).

• --quiet

  Suppress the summary line.

What leaves my machine?

A live URL is validated by createmcps.com, not inside the package. That keeps the rule set current — a copy bundled into your CI would go stale and report green while the spec moved — and keeps the SSRF-safe probe sandbox in one place. So the CLI sends your target URL to createmcps.com, and the resulting report is public by default at the link printed in the output.

If that isn't acceptable, --offline sends nothing anywhere and checks a local server.json's structure, and --api points the CLI at your own deployment. Offline mode checks the fields a registry publish requires; it does not confirm a publish will succeed.