How We Score MCP Servers

Overview

How does the server handle credentials? Can a platform pass per-user tokens on each request, or does it read a single credential at startup? What are the operational implications for multi-tenant deployment?

This category scores how well the server supports multi-tenant deployment. Deductions stack: a stdio-only server with env var credentials and no OAuth hits all three checks for 0/25. An HTTP/SSE server without OAuth scores 18/25. A server implementing the full MCP OAuth spec scores 25/25. Authentication is weighted highest because it determines whether a platform can deploy one shared instance or must spawn one process per user.

Do all tool parameters have explicit JSON Schema types? Are required fields declared on write operations? Are there constraints like maxLength or enum on dangerous parameters? Are there raw shell/eval/SQL surfaces?

Tool schemas are the primary guardrail in an MCP deployment. They constrain what an LLM can send to a tool before it executes. Without types, required fields, and constraints, a prompt injection attack can pass arbitrary data to write, delete, or execute operations. Schema quality is the difference between a tool that's safe to expose to an AI agent and one that's a liability.

Are read and write tools separate? Can destructive operations (delete, admin) be independently disabled? Do tool descriptions specify what resources they can access?

Least privilege is critical when an AI agent decides which tools to call. If read and write operations are bundled together, the platform cannot give an agent read-only access. If destructive operations (delete, purge, admin) are mixed with regular CRUD, they cannot be independently disabled. Granular tool separation lets enterprises expose only the capabilities each agent role needs.

Are all tool descriptions present, specific, and free of manipulative language? Could any description cause the LLM to select the wrong tool or follow hidden instructions? Are there overlapping descriptions that create ambiguity?

LLMs select tools based on their descriptions. A vague or missing description means the LLM is guessing which tool to call, potentially triggering a destructive operation when a read was intended. Hidden instructions in descriptions can hijack the LLM's behavior in multi-server deployments. Overlapping descriptions create ambiguity that leads to wrong tool selection. This combines what used to be separate Description Quality and Injection Resistance categories.

Do list operations have pagination? Do tool responses return minimal fields or entire records? Could error messages leak credentials or internal paths?

Tool responses flow back into LLM context windows, which may be logged, cached, or shared across users. A list operation without pagination could dump an entire customer table into context. Returning full records with PII when only an ID was needed is a data leak. Error messages that include credentials or internal paths are exploitable. The platform can mitigate some of this with response filtering, but the server should minimize exposure at the source.

Is the server maintained by the service vendor or a community contributor? Is it actively updated? Does it have a changelog?

Vendor-maintained servers signal long-term reliability: the company behind the service has an interest in keeping the MCP server working and secure. Community-maintained servers may be abandoned. This is the least differentiating category because great community servers exist and vendor servers can still have technical issues, but it matters for enterprise procurement decisions.

Grade Thresholds

Scores are out of 100 and map directly to letter grades.

Audit Process

Disputes & Rescans