Read-only check of a public MCP endpoint: DNS/SSRF safety, TLS, initialize, tools/list sanity, latency. Never calls remote tools. Signed, logged result.