Methodology
Version 0.1.0 (prototype) · applies to data computed Thu, 12 Nov 2026 15:45:17 GMT. Changes are versioned; old results keep the version they were computed under.
The five states
Independent evidence supports the statement, within its freshness window.
Someone said it (the publisher or the registry record). Not independently checked yet.
Evidence conflicts with the statement.
It was checked, but the evidence is older than its freshness window.
We could not check it, and we say why. "Not analyzed" is never shown as verified.
Every tool page says when it was last checked. When that was more than 7 days ago, the page also says Re-check due, so older results never read as current.
Identity levels
- V1: one proven namespace (for example a GitHub account). Community: anyone can create an account named after a brand.
- V2: a proven domain (registry DNS/HTTP proof, or a GitHub-verified organization). Shown as Verified · the proven domain (for example "Verified · example.com"): it proves who published the tool, not that a company named in the tool made it.
- V3: V2, plus the source repository proven to belong to the same publisher. Shown the same way.
Not yet implemented in this version: our own DNS challenge and the 180-day domain-age rule.
Checks
| Check | What it establishes |
|---|---|
| Publisher identity identity.registry_namespace | The official MCP Registry only accepts a namespace from someone who proved control of it: a GitHub sign-in for io.github.* names, or a DNS/HTTP proof for domain names. We cite that proof. |
| Repository ownership identity.repo_matches_namespace | The source repository belongs to the same publisher as the namespace (same GitHub account, or a GitHub-verified organization that lists the namespace domain). |
| Organization verification identity.github_verified_org | GitHub shows the owning organization as verified (it proved a domain to GitHub). |
| Source availability source.public_repository | A public source repository is declared and reachable. |
| Maintenance maintenance.activity | Archived repositories fail; a push within 90 days passes; otherwise inconclusive. |
| License license.spdx | A recognized SPDX license is detected on the repository. |
| Artifact provenance provenance.attestation | npm packages: a build attestation is published with the version. PyPI: a PEP 740 provenance record exists. Container images and bundles: not checked yet (shown as Unknown). |
| Install scripts code.install_scripts | npm packages: the published version declares no preinstall/install/postinstall/prepare scripts. |
| Known vulnerabilities advisories.osv | The OSV database lists no advisory for this exact package version. |
| Version evidence freshness.registry | The latest registry version is active (not deprecated). |
Change detection
We compare consecutive registry versions. High: an artifact source is replaced, or a new network host appears on a different domain. Medium: an additional distribution channel, a first hosted endpoint, or a newly requested credential. Low: description text changed. Routine version bumps are not changes.
Sandbox run
To record what a package does, we may install and start it in a separate, temporary test machine. The tool's code runs as a user with no network access and finds only fake credential files planted where real ones usually live. We record whether it reads those files, tries to connect out, or prints one of the fake keys, and whether it starts and lists its tools. We never call a tool's functions.
Every tool page shows one of three results, and none is left blank:
- Ran, with the date and what was seen. "Nothing seen in that test" is evidence of that one test, not a guarantee: code can wait, or detect a test machine, and behave differently on your systems.
- Not run yet: the package can be run, but has not been.
- Cannot be run by us, with the reason: today only npm packages are run; Python, Rust, NuGet and container packages and MCP bundles are not yet, and a hosted server's code runs on its publisher's servers.
Evidence grade
Some tool pages show an evidence grade from A to E: how much our checks could confirm, not a safety rating.
- What it measures: the share of the listed checks that confirmed what they check, for this tool, on the date shown. Checks that cannot apply to a tool's kind (for example a hosted server has no package to inspect) are left out of the count. A check that did not run counts as not confirmed.
- The letters: A all listed checks confirmed (at least 4); B at least 70% confirmed, including the publisher's identity; C at least 40%; D below 40%; no letter when nothing could be confirmed ("Not enough evidence yet").
- E only when a listed check found evidence against the listing: the repository belongs to someone other than the publisher, an open security advisory or a listing in the OpenSSF malicious-packages database, an archived repository, or a version its publisher deprecated. The page names which one.
- A grade older than the re-check window shows at most C until the checks run again.
- A-E measures only the listed checks on the date shown.
- It is not a security audit, endorsement, warranty or certification.
- It is not a statement about the publisher.
- Publishers can request a recheck: [email protected].
- The same method applies to every tool. Grades are computed, never edited by hand. Each grade shows its method version.
What we do not do
- We never call a tool “safe”. No warnings means the checks that ran raised nothing.
- We do not run third-party tools on our own systems or on yours. Packages run only in the separate test machine described under Sandbox run; hosted servers are read the way any AI client reads them (what we read), and we never call a tool.
- Payment never changes a state, a ranking or a finding.
- Popularity (stars, downloads) is shown but never affects any state.
Where the data comes from
Catalog: public registries and directories of MCP servers and web APIs, combined into one entry per tool. Evidence: public package, repository and vulnerability records. Every statement links to its evidence record (URL, fetch time, SHA-256), so you can check each one yourself. Registry mirror: 62,760 servers, last synced Thu, 12 Nov 2026 15:45:19 GMT.
An entry found only in a public catalog, package index or code host is Listed: no publisher has proven a namespace for it, and none of our checks have run on it until it is analyzed.
62,687 servers are analyzed with all checks; the rest are listed and say so.