MCP configuration: understand structure, connection and permissions
Three separate steps make MCP setup easier to troubleshoot: review the file structure, test the connection, then assess the server and requested permissions. A structure check covers the first step; connectivity and trust need their own checks.
Three different questions
First: can the application read the configuration? Second: does the connection and server work? Third: are the source and permissions appropriate for your data? A yes to the first does not answer the others.
MCP connects a client to a server that provides capabilities. A server may be a local program using stdio or a service using HTTP; the transport changes what must be reviewed in configuration and operation.
References: Model Context Protocol — Clients, servers and transports
Check the format your client actually accepts
ToolRoof checks a declared JSON subset under mcpServers: either command with optional args and env, or url with optional headers. Both command and url in one entry are an error here; unknown fields produce warnings.
This is not the configuration format of every MCP application. Your client may use other fields or another format. Consult its documentation instead of deleting valid settings simply because a checker does not cover them. The tool does not run commands, visit endpoints or test authentication.
A warning is not comprehensive secret detection
Arguments, environment variables and headers can contain sensitive data. The checker flags locations to review; it does not establish that every value there is a secret or that a warning-free file contains none.
Do not share a real configuration in a public support report. Use a redacted example and review the server source and permissions in your client before connecting it. HTTPS and valid JSON do not automatically establish trust.
Example: a correct result with a narrow meaning
The configuration {"mcpServers":{"notes":{"url":"https://example.com/mcp","type":"http"}}} describes one server in the supported subset. Passing means its shape is acceptable. Here example.com is an illustrative address, not a tested MCP server.
Adding command to that same entry makes its transport ambiguous and fails this check. Adding headers with {"X-Mode":"demo"} instead triggers a data-review warning while leaving the structure valid; the warning does not mean the word demo is a secret credential.