Methodology
How we score MCP server trust
Every grade in this registry comes from the same open rubric, run by the same open-source scanner. This page is that rubric in full — the checks, the point maths, and the boundaries between letters. Nothing here is editorial: if a page shows a grade, it came out of the process below.
Stars measure popularity. We measure supply-chain risk.
A GitHub star count tells you that people liked a project. It tells you nothing about whether the server authenticates its callers, pins its dependencies, or quietly re-registers its tools after you have approved them. Those are the failure modes that matter once an agent is holding your credentials, and they are what the OWASP MCP Top 10 enumerates.
So we scan instead of counting. The scanner connects to the server the way a client would, exercises it against ten checks, and reports what it found — including when it could not reach the server at all.
The 10 checks
Derived from the OWASP MCP Top 10. This list is read from live scan results at build time, so it is always the rubric the scanner is actually running.
MCP01Tool PoisoningMCP02Insufficient Input ValidationMCP03Resource InjectionMCP04Unauthorized Capability ExposureMCP05Missing AuthenticationMCP06Insecure TransportMCP07Shadow Tool RegistrationMCP08Lack of Audit and TelemetryMCP09Inadequate Rate LimitingMCP10Supply Chain Risk
PASS, WARN, FAIL, SKIP
Each check returns one of four verdicts. The fourth one is the one most scoring systems get wrong.
- PASSThe check found no problem. Full points.
- WARNPartially satisfied, or we could not fully verify it. Partial points.
- FAILThe check found a real problem. No points.
- SKIPNot applicable to this transport — HTTP-only checks are skipped for stdio servers. Excluded from the score entirely, never counted as a failure.
From checks to a 0–100 score
Applicable checks only. We sum the points a server earned across every non-SKIP check, divide by the points those checks could have awarded, and scale to 100:
score = round(points earned / points available × 100)
Skipped checks leave the denominator entirely. A stdio server is not punished for lacking HTTP transport security, and it does not get free credit for it either — the check simply is not part of its score.
Score to grade
Five bands. The counts below are live as of this build, most recent scan 2026-08-01.
| Grade | Score | What it means | Scored today |
|---|---|---|---|
| A | 90–100 | Passes essentially every applicable check. | 0 |
| B | 75–89 | Solid posture with a few gaps worth reading. | 498 |
| C | 60–74 | Real gaps. Read the per-check breakdown before connecting an agent. | 987 |
| D | 40–59 | Multiple failures against the Top 10. | 21 |
| F | 0–39 | Fails most applicable checks. | 0 |
No server has earned an A yet, and none has scored low enough for an F. We publish the empty bands anyway — hiding them would make the distribution look better than it is.
Coverage, and what we do not know
The registry lists 6,901 servers. 1,506 of them carry a trust score — about 22% of the index.
The gap is not neglect. A scan has to actually connect, and most MCP servers are credential-gated — they want an API key we do not have and will not fabricate. Those servers stay listed with no grade rather than a guessed one, and they are marked as unindexable rather than padding search results with empty pages.
Unknown is not unsafe. An unscored server may be excellent. It only means nobody has pointed the scanner at it with working credentials — which you can do yourself, below.
Scan anything yourself
The scanner is open source and the rubric on this page is the rubric it applies. It grades any MCP server in seconds, including ones this registry has never seen.
npx mcpr scan <target>
Disagree with a grade? The scanner is on GitHub — the check that produced it is readable, and so is its verdict.
Frequently asked questions
- What is the MCP Registry trust score based on?
- Ten checks derived from the OWASP MCP Top 10, run against the live server by the open-source MCP Vouch scanner. Each applicable check earns points; the total is the points earned divided by the points available, scaled to 0–100. Checks that do not apply to the server's transport are skipped and excluded from the denominator.
- Does a low grade mean the server is malicious?
- No. The score measures supply-chain and configuration risk against a fixed rubric — missing authentication, insecure transport, unpinned dependencies, and so on. A low grade means there are gaps worth reading before you connect an agent, not that the maintainer acted in bad faith.
- Why do most servers have no score at all?
- A scan requires actually reaching the server, and most MCP servers are credential-gated — they need an API key we do not have. Those servers stay listed and unscored rather than being guessed at. Unknown is not the same as unsafe.
- Can I scan a server myself?
- Yes. The scanner is open source and runs locally: `npx mcpr scan <target>` grades any MCP server in seconds, including ones that are not in the registry. The rubric on this page is the rubric it applies.
- How often are scores refreshed?
- Scores are re-run on a schedule and the site rebuilds from the latest results, so a page reflects the most recent successful scan. Every grade is stamped with the date it was scanned.