shriramkv/mcp-fuzz

mcp-fuzz is a stdlib-only Python robustness harness for AAIF that throws 17 malformed and adversarial JSON-RPC cases at an MCP server over stdio and grades it A to F on crash resistance, responsivenes

About mcp-fuzz

A robustness and negative-test harness for Model Context Protocol servers. mcp-fuzz throws malformed and adversarial JSON-RPC at a server over stdio and grades how gracefully it degrades: does it stay alive, return well-formed JSON-RPC error objects, stay silent to notifications, and remain responsive afterwards.

It is a defensive quality tool. You point it at your own server before you ship, the same way you would run a linter or a fuzz test in CI. Zero dependencies, stdlib only, Python 3.9+.

Most MCP quality tooling checks a server on well-formed input (does a valid request return a valid result) or measures performance. Almost nothing checks what happens on the ragged edge: a truncated line, a batch array, a 200 KB argument, an unknown notification, an id that is an object. That edge is exactly where servers crash, hang, or leak malformed responses in production. mcp-fuzz fills that gap and slots in as a robustness dimension alongside conformance, surface-hygiene, and load testing.

There is nothing to install to try it, though. The package ships a sample server:

Fuzz your own server by giving the command that launches it over stdio:

Fuzz the bundled robust sample (scores A) or the bundled fragile server (crashes on the first bad line, to show detection):

Seventeen cases across seven categories. Each is followed by a liveness probe, so a crash or hang is caught wherever it happens.

From the project README.

Maintaining this server?

Add the radar badge to your README — it shows your project was picked up by MCP Radar and links to this page:

[![On MCP Radar](https://mcp.liqiwa.com/badge.svg)](https://mcp.liqiwa.com/s/shriramkv--mcp-fuzz.html)

Related MCP servers