How scores are made
Every number on MCPWatch comes from public data and a fixed, published rule set. When we don't have data for a factor, we say so — we never assume it's good or bad.
Which servers
All latest-version entries from the official MCP Registry (registry.modelcontextprotocol.io/v0/servers) that ship an npm or PyPI package, ranked by last-week downloads (api.npmjs.org, pypistats.org). The top 500 are tracked.
Score (0–100)
The sum of points below, divided by the maximum points of the factors we actually have data for. Unknown factors are excluded and listed on each server page. Under 50 points of evidence, the score is labelled “insufficient data”.
| Factor | Max | Source | Rule |
|---|---|---|---|
| Known advisories | 40 | OSV.dev | −20 per advisory whose affected versions include the current version; −2 per historical advisory (max −8). |
| Maintenance | 20 | GitHub | Pushed <90 days: 20; <365 days: 10; older or archived: 0. Unknown if no repo/API data. |
| Source transparency | 15 | GitHub | Public GitHub repo with license: 15; repo without detected license: 10; no repo: 0. |
| Metadata stability | 15 | Registry snapshots | −10 for each observed risky change without a version bump: remote host change, package identifier / registry type / image repository change, runtime command or code-executing argument change, new or removed required secret env vars, tool list change. Version-only, tracking-parameter and description text edits do not count. |
| Adoption | 10 | npm / PyPI | ≥10k weekly downloads: 10; ≥1k: 6; ≥100: 3; else 0. |
Rug-pull detection
Each night we snapshot the metadata a client sees in the registry — description, package arguments, environment variables, remotes, and tool lists when published — and store a structural diff when anything changes. Each diff entry is then classified. Risky (alerted on /alerts): remote URL host, scheme or port change; package identifier or registry type change; Docker image repository change; runtime command change or new arguments that execute code or redirect package sources; new or removed required secret-looking env vars (and env vars such as NODE_OPTIONS that change code loading); new remote hosts or packages; tool list changes. Informational (kept in the server's change timeline only): version bumps, image tags, download URLs and arguments that only follow the new version, URL edits limited to tracking parameters (utm_*, src, ref…) or a trailing slash, description/title text edits, and optional non-secret env vars. Risky changes without a version bump also lower the stability score. The registry does not currently publish tool names, descriptions or schemas, so tool-level tracking is shown as unknown until a source exists.
Limitations
- OSV matching is by package name; a clean result is not proof of safety.
- This score is a heuristic, not an audit. It does not inspect code.
- GitHub data may be marked unknown when API rate limits are hit.