scout check for MCP servers: The first release runs a nine-phase diagnostic against an MCP server and prints a plain-language verdict, a score out of 100 and a numbered list of what to improve. Reports are also written as Markdown, JSON or NDJSON.
Both protocol generations: scout detects whether a server speaks the handshake revision or the stateless 2026-07-28 revision, reports it as handshake.protocol_era, and runs the full diagnostic on either.
Credentials that stay where they belong: Bearer tokens, API keys, HTTP basic, OAuth client credentials and the interactive PKCE flow are supported. Credentials never follow a redirect to another origin, and by default discovered OAuth endpoints must use HTTPS and a public host.
Signed release packages: Signed archives for Linux, macOS and Windows ship with a CycloneDX SBOM, alongside deb/rpm packages, a Homebrew cask, an AUR PKGBUILD and a container image. Build provenance was meant to ship too, but only arrived in 0.0.2.