Skip to content
MCPSTAMP
MCP server report

AppGoat MCP server

ai.appgoat/mcp

We checked this server on 2 November 2026 with McpStamp Check engine 1.2.0. It scored 96 of 100 (grade A), higher than 77.1% of the 33,003 registry servers that responded over HTTPS that day. Ready for ChatGPT, Gemini and MCP Registry. Not ready for Claude.

Measured facts

Score
96A
Sign-in
OAuth
Tools listed
26
Protocol version
2025-11-25
Stores

Store readiness

StoreStatusReason
Claude Connectors Directory Not ready Blocked by Resource metadata "resource" equals the server URL.
ChatGPT app directory Ready No blocking check failed.
Gemini Connected Apps Ready No blocking check failed.
Official MCP Registry Ready No blocking check failed.

MCP Registry ready means a valid public remote for the registry, not that the server is listed in a store.

Fixes

2 checks to fix

  1. Fails

    Resource metadata "resource" equals the server URL

    auth_resource

    Blocks Claude.

    Measured resource https://api.appgoat.ai is not the server URL https://api.appgoat.ai/mcp

    Serve metadata whose "resource" is exactly https://api.appgoat.ai/mcp (Claude requires an exact match, path included), e.g. at /.well-known/oauth-protected-resource/mcp.

  2. Warning

    JSON-RPC error for unknown method

    jsonrpc_errors

    Measured HTTP 401 instead of a JSON-RPC error

    Route the method first and answer unknown methods with JSON-RPC error -32601 before the auth check, or return a JSON-RPC error body with the 401.

25 checks passed

Passed. Served over HTTPS, initialize over Streamable HTTP, Supported protocol version negotiated, JSON or SSE response Content-Type, GET answers SSE or 405, initialize latency, serverInfo name and version, Server instructions, tools capability declared, Sign-in method the store supports (OAuth or none), 401 carries WWW-Authenticate resource_metadata, Protected resource metadata (RFC 9728), Authorization server metadata (RFC 8414 / OIDC), First metadata URL Gemini tries answers 200 with the required fields, issuer equals the authorization_servers entry; token_endpoint_auth_methods_supported (ChatGPT), PKCE S256 advertised, Client registration (DCR or Client ID Metadata Documents), refresh_token grant advertised, tools/list returns tools, inputSchema is an object schema, Tool names are valid and portable, readOnlyHint or destructiveHint on every tool, Explicit readOnlyHint, destructiveHint and openWorldHint (ChatGPT), Human-readable title on every tool, Tool descriptions.

Run a fresh check

This page is the 2 November 2026 snapshot. If you maintain this server and have shipped fixes since then, re-check it. The live check and the badge show the current result, and the next snapshot will pick up the change.

Re-check now

Badge

README badge

The badge shows the latest score for this URL and links to this report.

McpStamp score for AppGoat

Markdown

[![McpStamp score](https://www.mcpstamp.com/badge?url=https%3A%2F%2Fapi.appgoat.ai%2Fmcp)](https://www.mcpstamp.com/r/ai-appgoat-mcp/)

HTML

<a href="https://www.mcpstamp.com/r/ai-appgoat-mcp/"><img src="https://www.mcpstamp.com/badge?url=https%3A%2F%2Fapi.appgoat.ai%2Fmcp" alt="McpStamp score" height="20"></a>
Registry entry

About this server

App Store and Google Play data: apps, reviews, keywords, charts, competitors, ASO playbooks.
Registry name
ai.appgoat/mcp
Remote URL
https://api.appgoat.ai/mcp
Version
0.2.0
Website
appgoat.ai
Checked
2 November 2026, engine 1.2.0, no credentials

The description above is the server's own text from the official MCP Registry. If a result looks wrong, run a fresh check and email support@zovo.one with the report link.

More grade A servers

All grade A servers · All server reports · State of MCP readiness, November 2026