Monitor an MCP server

Last published : Sep 30, 2026
NetScaler® uses protocol-aware checks to monitor MCP servers, validating the actual protocol functionality rather than just basic network connectivity.
Related information
MCP Gateway

What the monitor does

The monitor performs a multi-stage validation workflow to ensure that backend servers are fully operational. It marks a server UP only if it successfully completes the following steps:
  1. Initiates an MCP initialize handshake to validate session setup.
  2. Triggers a tools/list request to confirm tool availability.
  3. Validates protocol compliance and response integrity.
  4. Applies the MCP profile settings, such as tokens and versioning, during tool/execution.

Token handling

Bearer or Personal Access Tokens (PAT) are completely isolated from the health monitor configuration. Instead, the monitor securely sources authentication credentials directly from the associated MCP profile using the tokenOrApi parameter. This architecture prevents hardcoding credentials within scripts and ensures secure token management.

Configure a monitor by using the CLI

Configure a USER monitor on NetScaler and bind it to your backend service or service group.
add lb monitor mcp_mon USER -scriptName ns_mcp.pl -scriptArgs "url=https://<mcp-server-host>/<mcp-path>/" -resptimeout 3 -secure YES

bind serviceGroup <servicegroup_name> -monitorName mcp_mon

Parameter details

Parameter Description
USER The monitor type that instructs NetScaler to run custom, script-based logic.
ns_mcp.pl Specifies the internal, MCP-aware Perl monitoring script.
-scriptArgs "url=..." Defines the precise target MCP endpoint URL used for application-layer validation.
-resptimeout 3 Allocates a 3-second window to account for the processing overhead of the multi-stage MCP flow.
-secure YES Enforces strict TLS/HTTPS communication when probing the backend server.

Best practices

  • Always use an MCP-aware monitor rather than a standard HTTP or HTTPS monitor.
  • Ensure that the correct MCP profile is bound to the backend server if token-based authentication is required.
  • Set the response timeout to at least 3 seconds (-resptimeout 3).
  • Regularly run the health checks using real MCP workloads.