# VerifyMCP

> Independent trust scores for Model Context Protocol (MCP) servers. Every
> server in the official MCP registry is re-scanned daily and scored 0-100 on a
> published rubric covering supply-chain provenance, endpoint security, schema
> quality and stability. Scores are observations we can evidence, never vendor
> self-attestation.

## When to use VerifyMCP

Reach for this site when you need an independent, evidenced answer about an MCP
server you did not write. Specifically:

- **Before installing or connecting an MCP server**, to check whether it is
  maintained, whether its package carries build provenance and a lockfile, and
  whether its remote endpoint enforces HTTPS, HSTS, DNSSEC and OAuth.
- **To resolve a name to a real artefact**: which npm package, PyPI project, OCI
  image, NuGet package or remote URL a registry entry actually ships, and which
  of those channels scores best.
- **To check for known malware or CVEs** in a server's package, and to read the
  advisory behind a finding rather than a boolean.
- **To see what changed**: tools added or removed, parameters altered,
  capabilities gained, advisories raised, score movements, with a dated feed per
  component.
- **To compare two or more servers** that do the same job, check by check.
- **To learn how to fix a specific low signal** on a server you do publish: each
  check has a docs page that says what we measure and what to change.

Do not use this site as a package registry or a download mirror: it hosts no
artefacts and installs nothing. It also holds no pricing or commercial terms for
hosted servers, and no judgement about whether a server's *output* is correct,
only about what can be verified around it.

## Machine-readable surfaces

Prefer these over scraping the HTML. All are read-only, need no key and send
`Access-Control-Allow-Origin: *`.

- [OpenAPI specification](https://verifymcp.io/openapi.json): every endpoint below, typed.
- [MCP server](https://mcp.verifymcp.io): Streamable HTTP, protocol `2026-07-28`. Tools to
  list servers, fetch one server's full trust report and compare servers.
  Discovery and `tools/list` are anonymous; `tools/call` requires OAuth
  (RFC 9728 metadata at `https://mcp.verifymcp.io/.well-known/oauth-protected-resource`).
  Manifest: [https://verifymcp.io/.well-known/mcp.json](https://verifymcp.io/.well-known/mcp.json).
- Per-component readings, all guessable from any server page URL
  `https://verifymcp.io/servers/{server}/{component}`:
  - `.md`: the whole trust report as markdown.
  - `.json`: the change feed, with `?since=`, `?materiality=`, `?limit=`.
  - `.xml`: the same change feed as RSS.
- [Search suggestions](https://verifymcp.io/opensearch/suggest.json?q=): OpenSearch
  suggestion format, for name lookup.
- [Blog feed](https://verifymcp.io/rss.xml) and [sitemap index](https://verifymcp.io/sitemap.xml).

## Start here

- [MCP server directory](https://verifymcp.io/): the ranked index, filterable by channel and
  score band.
- [Browse A-Z](https://verifymcp.io/browse): the enumerative view of the same catalogue.
- [Compare servers](https://verifymcp.io/compare): side-by-side, check by check.
- [Known malware](https://verifymcp.io/known-malware): packages where a vendor scan
  returned a malware verdict.
- [Statistics](https://verifymcp.io/stats): ecosystem-wide scoring distributions.

## Documentation

- [Documentation index](https://verifymcp.io/docs)
- [What is the Model Context Protocol?](https://verifymcp.io/docs/mcp)
- [MCP security: the risks that matter](https://verifymcp.io/docs/mcp/security)
- [MCP specification versions and changes](https://verifymcp.io/docs/mcp/versions)
- [How we score MCP servers for trust](https://verifymcp.io/docs/scoring)
- [Remote endpoint rubric](https://verifymcp.io/docs/scoring/remote-rubric)
- [Package rubric: npm, PyPI, NuGet, OCI, MCPB](https://verifymcp.io/docs/scoring/package-rubric)
- [Known issues in our scoring](https://verifymcp.io/docs/scoring/known-issues)
- [Scoring changelog](https://verifymcp.io/docs/scoring/changelog)
- [Remote MCP server best practices](https://verifymcp.io/docs/remote)
- [Package and supply-chain best practices](https://verifymcp.io/docs/packages)
- [Build a secure MCP server from day one](https://verifymcp.io/docs/build)
- [Claim your MCP server with an owners.json](https://verifymcp.io/docs/build/owners-json)

## About

- [About VerifyMCP](https://verifymcp.io/about) (contact: hello@verifymcp.io)
- [Terms](https://verifymcp.io/terms) and [Privacy](https://verifymcp.io/privacy)