Trust score badge: embed a VerifyMCP score in your README

Every scored server has a badge: a small SVG on a stable URL that shows its current trust score and links back to the page the score is derived from. Paste it into a README or anywhere else that renders an image.

URL shape

Two URLs, mirroring the two pages they evidence.

<slug> and <component> are the same two segments as the server page you are reading them from: /servers/acme/npm-acme is badged by /badge/acme/npm-acme.svg.

The only accepted parameter is ?variant=. Anything else is ignored, and an unrecognised variant renders the default rather than an error, so a typo in a README still produces a badge instead of a broken image.

Snippets

Link the badge at the server’s page, so a reader can check the number rather than take it.

Markdown:

[![VerifyMCP trust score for Acme MCP](https://verifymcp.io/badge/acme/npm-acme.svg)](https://verifymcp.io/servers/acme/npm-acme)

HTML:

<a href="https://verifymcp.io/servers/acme/npm-acme"><img src="https://verifymcp.io/badge/acme/npm-acme.svg" alt="VerifyMCP trust score for Acme MCP" height="20"></a>

You do not have to write either by hand. Every server page with a scored channel carries a Badge card under its score breakdown, with both snippets filled in and a copy button on each. The card omits ?variant=score, because that is the default and says nothing.

The badge is 20px tall, so it sits on a line with shields.io badges without any adjustment.

Variants

The colour is the same three-band tier the rest of the site uses: green at 80 and above, amber from 60 to 79, red below 60. See the package rubric for how the number is arrived at.

Every variant carries the same accessible label, which does state the score. The verified badge hides the number from a sighted reader, not from a screen reader or from anyone reading your README’s source.

A server we have not scored

A component that has never been scored shows a dash, not a zero. Zero is a finding, and “we have not got to this yet” is not one. The badge’s accessible label says “is not yet scored by VerifyMCP” so a screen reader gets the same distinction.

A server we do not list

Four things render this: a slug we do not have, a channel that does not exist on that server, an entry the registry has marked deleted or deprecated, and a server we have judged dead after seven consecutive failed crawls. The route answers 200 with a neutral grey badge rather than a 404: your README is on somebody else’s page, and a broken image there is worse than an honest “not listed”.

A server that is merely degraded keeps its badge, showing the decaying score its page shows.

Caching

The badge is served public, max-age=3600, stale-while-revalidate=86400 with an ETag computed from the variant, the score, the channel and the server name. Scores move at most once a day, so an hour of caching costs you nothing in freshness. When the score does move the ETag changes and the next revalidation picks it up; when it has not moved, that revalidation is a 304 with no image body. An unknown slug is cached for five minutes only, so a server added since our last index refresh starts showing its real score within minutes.

GitHub serves README images through its own camo proxy, which caches on its own schedule regardless of what we send. A score change can therefore take longer than an hour to appear on GitHub specifically. There is nothing either side can do about that beyond waiting.

Notes for embedding

• The SVG is self-contained: no script, no stylesheet, no external font, no <image>. It uses a system font stack, so it renders with the reader’s own UI font.
• It survives GitHub’s README sanitiser, which strips anything more elaborate.
• The badge is an image, not a page. It is served X-Robots-Tag: noindex and is not in our sitemaps.
• The server name reaches the SVG only through its <title> and aria-label, never as drawn text, and is escaped and stripped of control and bidirectional-override characters first.