Where the data comes from
- The official MCP Registry (registry.modelcontextprotocol.io): the public list of servers, versions, packages and remote endpoints. We track 44,405 servers.
- Our own live checks: we connect to every public remote endpoint as a real MCP client.
- Public metadata: GitHub (stars, license, last push) and npm (weekly downloads).
Live checks
For each remote endpoint we send a real MCP initialize request, then tools/list. We don't just ping a URL.
- Live: correct MCP response. If no sign-in is needed, we record the full tool list.
- Live · sign-in: the endpoint correctly requires OAuth or an API key (HTTP 401/403 with proper auth headers). That's healthy, not broken.
- Down: timeout, TLS error, HTTP error, or malformed JSON-RPC.
- Local install: no public endpoint, so it runs on your machine and can't be checked remotely.
Checks are read-only. We never call tools, only list them.
Trust score (0–100)
| Factor | Points | How |
|---|---|---|
| Live reachability | 30 | Live 30, live with sign-in 27, degraded 12, down 0, local 18. Scaled by 7-day uptime. |
| Verified publisher | 20 | Official vendor of a known app 20, other registry-verified domain 17, verified GitHub account 12, other 6 |
| Maintenance | 15 | Days since last registry update or code push: under 30 days 15, then 12, 8, 4, 1. Archived 0. (Hosted servers without public code are judged by live checks instead.) |
| Track record | 10 | Age of the project (repo creation or registry publish, whichever is older): 180+ days 10, 90+ 8, 30+ 5, 7+ 3, newer 1 |
| Adoption | 15 | Log of GitHub stars and npm weekly downloads. No public repo or package means no adoption evidence (0), except official servers from widely used apps (12) |
| Transparency | 10 | Public repo 4, recognized license 3, real description 3. Hosted servers without a repo: description 3 + website 2, out of 5 |
| Tool quality | 10 | Share of tools with real descriptions and safety hints (read-only/destructive), when we can list tools |
If we can't measure a factor for a server (for example, a hosted server has no public repo, or it needs sign-in before listing tools), we leave that factor out and rescale the rest to 100. Nobody gets punished for data we can't see.
Grades: A 85+, B 70+, C 55+, D below 55.
What money can't buy
Featured placement changes position only, and it's always labeled. Status, grades and scores come from the formula above, for everyone.
Corrections
If something looks wrong, vendors can claim their listing and we re-check on request.