How we score
Every MCP gets a 0-100 security score from 15 checks — 10 about repository health, 5 about how the MCP itself exposes tools and auth. The score is a plain sum of each check's points, clamped to 0-100. No hidden multipliers.
Risk levels
| 80-100 | Safe |
| 60-79 | Use with caution |
| 0-59 | High risk |
Repository health (max +101)
| Check | Points | Rationale |
|---|---|---|
| official_maintainer | +18 / 0 | Official vendor > random fork. |
| editorially_verified | +5 / 0 | We've manually reviewed it. |
| actively_maintained | +12 / +6 / 0 | Commit age: ≤90d / ≤365d / older. |
| established_contributor_base | +10 / +5 / 0 | Bus-factor: ≥5 / ≥2 / 1 contributors. |
| community_adoption | +10 / +5 / 0 | Stars: ≥1000 / ≥100 / fewer. |
| has_license | +8 / 0 | Unlicensed code has unclear usage terms. |
| reasonable_dependency_footprint | +5 / +2 / 0 | Fewer deps = smaller supply-chain surface. |
| has_homepage_or_docs | +3 / 0 | Signals a maintained, documented project. |
| has_substantial_readme | +5 / 0 | README ≥ 500 chars. |
| repo_archived | 0 / −40 | Archived = no further fixes, ever. |
MCP-specific signals
| Check | Points | Rationale |
|---|---|---|
| readonly_mode_available | +15 / 0 | A safer way to run it should exist. |
| supports_oauth | +10 / 0 | Stronger than static tokens. |
| dangerous_tools_present | 0 / −10 / −25 | Share of tools flagged execute/delete/write. |
| dangerous_tools_without_safe_mode | 0 / −20 | Dangerous tools + no read-only escape hatch. |
| weak_or_missing_auth | 0 / −15 | No auth method — anyone with the config can use it. |
What this is — and isn't
- This is a trust score built from public signals, not a penetration test or vulnerability scan.
- Dependency count is a raw number, not a freshness or CVE check — we don't query package registries per dependency yet.
- Read-only mode, OAuth support, auth method, and tool risk levels aren't auto-detected from code yet — they come from manual or AI-assisted review until deeper tool extraction exists.
- Contributor counts are capped at the first 100 — a floor, not an exact count, for very large projects.