That makes it a sweep and not a probe — you cannot point it at a named server, and doctor is the single call that covers connectivity, configuration security and latency at once. The security audit is the part that is hard to get elsewhere, because it reads the configuration files themselves for secrets written inline and for tokens passed as command arguments, where a process listing exposes them. The handshake in scan is a real JSON-RPC exchange rather than a reachability check, so a server that starts but never completes the handshake shows up as broken rather than fine.
A diagnostic for your own MCP installation: it discovers the server configurations present on the machine and reports connectivity, configuration security and response latency for them.
- scan discovers the MCP server configs and tests each connection with a JSON-RPC handshake, which separates a server that is misconfigured from one that is merely absent.
- security audits those same configs for hardcoded secrets, tokens passed in args and shell injection patterns — properties of how a server was wired up rather than of the server itself.
- bench measures response latency across the configured servers, so a slow session can be traced to a specific one.
- doctor runs the connection scan, the security audit and the latency benchmark together in a single call.
MCP server configurations already present on the machine the server runs on. No account, no key, and no arguments — every tool operates on whatever it discovers.
One command — npx @wigu/mcp-doctor