12 Checks Before an MCP Server Touches Production Agents

A new go/no-go rubric scores an MCP server on 12 checks split across two tiers, and tells you to stop at anything under 5/6.

It is aimed at the question most teams still answer by feel: do we wire this server into an agent that real users depend on, or not? The rubric's framing is blunt — protocol tests and agent-facing tests are "two different failure surfaces, and conflating them is the single most common mistake teams make when they say a server is 'tested.'"

Tier 1: six protocol checks, scored 0/1

These run against the raw protocol with no LLM involved, and belong in CI rather than a pre-release eyeball. The six cover schema validity against the handler's actual accepted inputs, structured errors instead of stack traces, at least one negative test per documented tool, timeouts that are distinguishable from success, per-call token validation, and measured p95 latency.

Two of them carry the sharpest reasoning. On auth: "Long-lived sessions with front-loaded auth checks are a common gap once bearer tokens get forwarded." On latency: "A tool that's 200ms in dev and 5s under load stalls the agent's reasoning loop and can trigger retries that compound the problem."

Under 5/6 here and you stop. Running agent-level evals on a shaky protocol layer, the rubric argues, "just produce noisy, non-repeatable results."

Tier 2: six checks almost nobody automates

This tier requires actually running an agent against the server instead of curling endpoints. The harness must use the same transport, auth path and tool list as production — one that "skips OAuth or substitutes a shortened tool list is measuring a different configuration."

The rest are about what a single pass/fail number hides. Score tool selection separately from argument construction and outcome. Run every task multiple trials, not once. Include adversarial and near-miss prompts — cases similar to the intended use that shouldn't activate the server. Check system state after a run, because "a trajectory can 'look' successful while leaving duplicate writes or half-completed operations behind." And test recovery, not just failure detection.

Same scoring: 0/1 per row, and under 5/6 is "not yet," not "close enough."

What the market actually ships

A separate comparison of eight design-oriented MCP servers, published 26 September 2026, shows how much Tier 1's "same transport, same auth path" check matters in practice. The servers do not converge on one shape: SVG Lab runs remote over streamable HTTP with OAuth and no key, SVGator remote over OAuth, Figma remote OAuth plus a desktop server for reads, Penpot on your own Penpot instance alongside an in-app plugin, and SVGMaker as a local npx server or remote — API key locally, OAuth remote.

Pricing is just as scattered. Published cost as of 26 September 2026: SVG Lab Plus at $20 a month for 5,000 requests and Max at $40 a month for 15,000 requests; Figma's write-to-canvas free during beta, moving to usage-based, and requiring a Full seat; Penpot open source; SVG Genie and SVG AI credit-based. Note that comparison is published by SVG Lab, and it names its own server the best pick for agent-designed UI — read the ranking as a vendor claim, the connection and pricing table as the useful part.

What to do before your next release

Score your server 0/1 down both tiers this week and write the two numbers into the README. A server at 4/6 and 3/6 is early, not broken — the rubric's recommendation is to say so in writing, noting what an integrator should assume is their responsibility until it is fixed.

The one line worth carrying into a design review: if the server has no concept of budgets, quotas or side-effect governors, it is asking the orchestrator to do all the defensive work.