How we score

Every MCP gets a 0-100 security score from 15 checks — 10 about repository health, 5 about how the MCP itself exposes tools and auth. The score is a plain sum of each check's points, clamped to 0-100. No hidden multipliers.

Risk levels

80-100Safe
60-79Use with caution
0-59High risk

Repository health (max +101)

CheckPointsRationale
official_maintainer+18 / 0Official vendor > random fork.
editorially_verified+5 / 0We've manually reviewed it.
actively_maintained+12 / +6 / 0Commit age: ≤90d / ≤365d / older.
established_contributor_base+10 / +5 / 0Bus-factor: ≥5 / ≥2 / 1 contributors.
community_adoption+10 / +5 / 0Stars: ≥1000 / ≥100 / fewer.
has_license+8 / 0Unlicensed code has unclear usage terms.
reasonable_dependency_footprint+5 / +2 / 0Fewer deps = smaller supply-chain surface.
has_homepage_or_docs+3 / 0Signals a maintained, documented project.
has_substantial_readme+5 / 0README ≥ 500 chars.
repo_archived0 / −40Archived = no further fixes, ever.

MCP-specific signals

CheckPointsRationale
readonly_mode_available+15 / 0A safer way to run it should exist.
supports_oauth+10 / 0Stronger than static tokens.
dangerous_tools_present0 / −10 / −25Share of tools flagged execute/delete/write.
dangerous_tools_without_safe_mode0 / −20Dangerous tools + no read-only escape hatch.
weak_or_missing_auth0 / −15No auth method — anyone with the config can use it.

What this is — and isn't

  • This is a trust score built from public signals, not a penetration test or vulnerability scan.
  • Dependency count is a raw number, not a freshness or CVE check — we don't query package registries per dependency yet.
  • Read-only mode, OAuth support, auth method, and tool risk levels aren't auto-detected from code yet — they come from manual or AI-assisted review until deeper tool extraction exists.
  • Contributor counts are capped at the first 100 — a floor, not an exact count, for very large projects.