Monitor an MCP server

What the monitor does

The monitor performs a multi-stage validation workflow to ensure that backend servers are fully operational. It marks a server UP only if it successfully completes the following steps:

Initiates an MCP initialize handshake to validate session setup.

Triggers a tools/list request to confirm tool availability.

Validates protocol compliance and response integrity.

Applies the MCP profile settings, such as tokens and versioning, during tool/execution.

Token handling

Bearer or Personal Access Tokens (PAT) are completely isolated from the health monitor configuration. Instead, the monitor securely sources authentication credentials directly from the associated MCP profile using the tokenOrApi parameter. This architecture prevents hardcoding credentials within scripts and ensures secure token management.

Configure a monitor by using the CLI

Configure a USER monitor on NetScaler and bind it to your backend service or service group.

add lb monitor mcp_mon USER -scriptName ns_mcp.pl -scriptArgs "url=https://<mcp-server-host>/<mcp-path>/" -resptimeout 3 -secure YES

bind serviceGroup <servicegroup_name> -monitorName mcp_mon
<!--NeedCopy-->

Parameter details

Parameter	Description
`USER`	The monitor type that instructs NetScaler to run custom, script-based logic.
`ns_mcp.pl`	Specifies the internal, MCP-aware Perl monitoring script.
`-scriptArgs "url=..."`	Defines the precise target MCP endpoint URL used for application-layer validation.
`-resptimeout 3`	Allocates a 3-second window to account for the processing overhead of the multi-stage MCP flow.
`-secure YES`	Enforces strict TLS/HTTPS communication when probing the backend server.

Parameter

Description

USER

The monitor type that instructs NetScaler to run custom, script-based logic.

ns_mcp.pl

Specifies the internal, MCP-aware Perl monitoring script.

-scriptArgs "url=..."

Defines the precise target MCP endpoint URL used for application-layer validation.

-resptimeout 3

Allocates a 3-second window to account for the processing overhead of the multi-stage MCP flow.

-secure YES

Enforces strict TLS/HTTPS communication when probing the backend server.

Best practices

Always use an MCP-aware monitor rather than a standard HTTP or HTTPS monitor.

Ensure that the correct MCP profile is bound to the backend server if token-based authentication is required.

Set the response timeout to at least 3 seconds (-resptimeout 3).

Regularly run the health checks using real MCP workloads.

What the monitor does

Token handling

Configure a monitor by using the CLI

Parameter details

Best practices

In this article