How we score MCP servers
Every score is deterministic (same server → same score), evidence-based (every point traces to a concrete check), and focused on security, not popularity. Re-run it and you get the same answer.
1. We run named controls
We check each server against a fixed catalog of security controls across six areas: code safety, secrets, dependencies, tool integrity, transport & auth, and maintenance. Each control passes, warns, or fails, with the evidence that decided it (a file:line, a CVE id, a dependency).
2. The score is earned, then capped
The base score is the share of checks a server passes(a warning counts as half). A clean, well-built server earns a high number; absence of evidence doesn't.
But a confirmed security flaw capsthe score, and good practices can't buy back a real hole. The worst confirmed issue sets a ceiling, and the final score is scaled into that ceiling (so two flawed servers still differ by their overall health):
| Worst confirmed issue | Score can't exceed |
|---|---|
| Critical | 20 |
| High | 49 |
| Medium | 74 |
| Low | 89 |
Example: a server with a confirmed command-injection flaw is capped at 20 and lands in F, no matter how good the rest of it is.
3. The score becomes a grade
4. Confidence caps the score
Confidenceis how much of the applicable checks we could actually run (e.g. we couldn't fetch part of the source). Absence of evidence is not safety, so a partially-scanned server can't present a high score no matter how clean the parts we saw were. Confidence sets a second hard ceiling:
| Confidence | Score can't exceed |
|---|---|
| 80% or more | no cap |
| 60–80% | 80 |
| 40–60% | 60 |
| Below 40% | 40 |
5. Some servers carry no score
If a server declares no public repository, or its source can't be retrieved (private, moved, or removed), we can't verify it, so we list it as unverified with no score, rather than inventing a misleading number.
What we deliberately keep out of the score
AI review is advisory only. An AI pass over tool descriptions surfaces things worth a human look, but it can be noisy, so it never moves the deterministic score.
Popularity is only a small nudge. Stars and downloads get a tiny, capped weight; a 10k-star server can still be insecure, so adoption can never offset a real security failure.
Every server page shows its full control checklist with evidence, so you can see exactly why it scored what it did. For how these scores come out across the whole ecosystem, see the MCP Security Index.