Home exposure check · Read-only probe

Is your home AI server exposed to the internet?

HomeShield MCP probes the public URL of your home MCP endpoint and tells you what the internet can see: reachable or not, auth present or wide open, MCP signature detected or not.

What the web can't see

No credit card required · Anonymous: 3 scans/day

Sample report · Real scan shape

EXPOSED

tunnel.example

Public MCP surface detected. The endpoint is reachable from the internet with no authentication, and it looks like an MCP server.

Auth challenge: No
MCP signatures: jsonrpc
HTTP status: 200

This is a sample card in the exact shape of a real report. Run the check to get yours.

Honest scope. HomeShield MCP detects public exposure of endpoints you declare — nothing more. It cannot audit your home LAN or your router from the web, and a clean report is not a clean bill of health. The Local-scan guide walks you through checking your own machine.

What the scan checks

Three questions, one read-only probe

Reachability

Does the URL answer from the public internet (HTTP 200, SSE stream, or error)?

Auth presence

Does the endpoint challenge with 401/403, or is it open to anyone?

MCP signature

Does the response look like an MCP server (SSE stream, JSON-RPC / tool-surface markers)?

What it never does

Never invokes tools, never sends payloads, never authenticates — read-only GET probes only.
Never touches private addresses: SSRF guards block LAN ranges, cloud metadata endpoints, and non-http(s) URLs before any socket opens.
Never stores probe response bodies — only verdicts and summaries.

Why this exists

Home AI servers increasingly sit behind public tunnels (ngrok, Cloudflare tunnels, port forwards). A misconfigured tunnel turns a "small server in your living room" into a public MCP endpoint with a tool surface anyone can reach. HomeShield MCP is the five-minute check.

Run the free scan