Verify your setup

When a client says “server failed to start” it rarely says why. These four checks narrow it down in order, each ruling out one layer.

1. Is the server up?

curl https://mcp.vulnetix.com/health

{"ok":true,"service":"vulnetix-mcp","protocol":"2026-07-28"}

Anything else (a timeout, an HTML page, a certificate warning) is network or DNS, not configuration. Check a corporate proxy or TLS-inspecting middlebox first.

2. Does the protocol answer?

curl -sS -X POST https://mcp.vulnetix.com/mcp \
  -H 'content-type: application/json' \
  -H 'accept: application/json, text/event-stream' \
  -H 'MCP-Protocol-Version: 2026-07-28' \
  -H 'Mcp-Method: tools/list' \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list","params":{
        "_meta":{
          "io.modelcontextprotocol/protocolVersion":"2026-07-28",
          "io.modelcontextprotocol/clientInfo":{"name":"curl","version":"1"},
          "io.modelcontextprotocol/clientCapabilities":{}
        }}}' | head -c 300

You should get a JSON-RPC result listing tools. This needs no credential, because the tool list is public.

Note The _meta block is not optional. Protocol revision 2026-07-28 carries the version, client identity and capabilities on every request instead of in a handshake. Omitting any of the three returns -32602 Invalid _meta envelope, which is easy to mistake for an auth failure.

3. Is your credential accepted?

curl -sS -X POST https://mcp.vulnetix.com/mcp \
  -H 'content-type: application/json' \
  -H 'accept: application/json, text/event-stream' \
  -H 'MCP-Protocol-Version: 2026-07-28' \
  -H 'Mcp-Method: tools/call' \
  -H 'Mcp-Name: vulnetix_kev' \
  -H "Authorization: ApiKey $VULNETIX_ORG:$VULNETIX_KEY" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{
        "name":"vulnetix_kev","arguments":{"limit":1},
        "_meta":{
          "io.modelcontextprotocol/protocolVersion":"2026-07-28",
          "io.modelcontextprotocol/clientInfo":{"name":"curl","version":"1"},
          "io.modelcontextprotocol/clientCapabilities":{}
        }}}' | head -c 400

A KEV entry means the credential works. "isError": true with a 401 message means it does not. Check you sent both halves of the key.

4. Does your client see it?

Each client has its own way of listing what it connected to:

Client	Check
Claude Code	`claude mcp list`, or `/mcp` in a session
Cursor	Settings → MCP, a green dot and a tool count
VS Code	`MCP: List Servers` in the command palette
Claude Desktop	Settings → Connectors
Windsurf	Settings → Cascade → MCP
Zed	The agent panel’s tool list

If steps 1–3 pass and step 4 fails, the problem is in the config file: wrong path, invalid JSON, or the client was reloaded rather than restarted. Most clients read MCP config once at launch.

Ask the agent to confirm

Run the vulnetix_auth_status tool and tell me which organisation I am connected as.

{
  "authenticated": true,
  "scheme": "ApiKey",
  "orgId": "56351b1a-18aa-48c5-9fea-9cc210a87235",
  "note": "Plan tier is reported by vdb-api on each response, not derived from the credential."
}

Then check your tier is what you expect by looking at _meta["vulnetix/plan"] on any other tool’s result.

Still stuck

Troubleshooting works through the specific failures: tools not appearing, -32602, -32020, empty exploit lists, timeouts and stale caches.