How grades are computed
Every grade on this registry is produced by the automated rubric below. It is disclosed in full so a grade can be re-derived and argued with, not taken on faith.
1. Danger-weighted score
Each risk dimension (0–10) is multiplied by a fixed weight, then summed and clamped to 0–10. Weights emphasize the dimensions that actually separate risk (shell execution above all) and down-weight ones that appear on benign and dangerous servers alike.
| Dimension | Weight |
|---|---|
| File access | ×1.2 |
| Network access | ×1.0 |
| Shell execution | ×2.0 |
| Destructive | ×0.3 |
| Exfiltration | ×0.4 |
2. Score → letter grade
| Grade | Danger score |
|---|---|
| A | ≤ 2.0 |
| B | > 2.0, ≤ 3.5 |
| C | > 3.5, ≤ 5.0 |
| D | > 5.0, ≤ 7.5 |
| F | > 7.5 |
Critical cap: any single finding of a disqualifying class (e.g. tool-poisoning or rug-pull) caps the grade at D regardless of score.
3. Transparency (a separate axis)
Transparency is the fraction of a server's tools that declare behavior annotations. It is reported alongside the danger grade, never folded into it. High ≥ 70%, medium ≥ 30%, otherwise low. A low-transparency server's danger grade is inferred from spec defaults, so a low grade there means cannot verify safe — not known dangerous.
4. What is scanned
Published package artifact scans (npm, PyPI, or equivalent) are installed and launched locally by the scanner, and hosted endpoint entries are labeled as hosted endpoint scans. The declared MCP surface (tools, prompts, resources, annotations) is read back. The public report records the sandbox image when available, but does not expose per-run network mode. Scans never use real credentials; where a server requires environment variables, at most inert placeholder values are used.
5. Grade freshness
A grade older than 90 days is marked stale on its page and badge, greys out, and is treated as historical until re-scanned. Vendors ship fixes; a grade never outlives its evidence silently.
6. How much grades have moved
Across 322 scans of 31 servers recorded between 2026-06-20 and 2026-07-04, this registry has recorded 7 grade changes. All 7 coincided with a change of scanner engine version. No declared tool surface changed in the 271 scan-to-scan comparisons where evidence was recorded on both sides. A grade movement attributed to a scanner engine change is a re-evaluation of the same recorded surface, not evidence that the server itself changed. Each server's full history, with the cause attributed to every step, is on its own page.
Scope and disputes
A grade is this registry's opinion, computed by this methodology against a specific package version on a specific date, both shown on each grade page. It is not an endorsement, certification, or claim of malice. Grades are re-checkable against the same package version; corrections are welcome at the issue tracker under the dispute & correction policy, and published grade changes live in the corrections log.