The rubric
Six components, 100 points. Components that don't apply (no package to scan, say) are left out of the denominator. Any critical finding is an F, no matter the score. A: 85+. B: 70+. C: 55+. D: 40+. F: below 40. D is hidden from default search. F is blocked at the gateway.
| Component | Weight | What we check |
|---|---|---|
| Code scan | 25 | Secrets, command injection from strings, eval, obfuscation, install scripts, curl-pipe-sh, calls to paste or tunnel hosts, environment dumps. Applied to the published npm or PyPI package. Not applicable to remote-only servers. |
| Live reliability | 20 | From real gateway calls over 30 days once there are 20 or more: success rate and p95 latency. Before that, a live probe of the remote endpoint. |
| Tool poisoning | 15 | Rules over the listing and every tool description: instruction overrides, hidden tags, do-not-tell-the-user, credential file reads, exfil nudges, role hijacks, zero-width characters. |
| Auth quality | 15 | OAuth on a 401 scores highest. Then enforced bearer auth, then API-key headers, then static env keys. Open endpoints exposing write-action tools score lowest. |
| Maintenance | 15 | Last push to the repository, archived flag. No repository listed is a low finding. |
| Maintainer identity | 10 | Registry namespace matches the repository owner, account age, organization, verified domain namespace with a matching website. |
Penalties
Critical: the grade is F. High: 12 points off the component. Medium: 5. Low: 2. A component never goes below zero.
Independence
No grade, badge or Certified mark is for sale. Sponsored slots are labeled and never mixed into ranked results. Certified audits cost the builder nothing. Panel members are named, paid per audit at a flat rate, rotated yearly, and declare conflicts. The founder does not vote on Certified.
Re-run it
The scanner is open source in the packages/scanner folder of the mcp.market repository. Run pnpm scan --slug=<slug> against your own database and you get the same report.