PredictionScan
REMOTE · MCP.PREDICTIONSCAN.ORG
Derived prediction-market flow, price changes, trader research and news. 11 read-only tools.
Available components
Last scanned (13 hours ago)
Scores higher than 57% of remote servers
Reachable. Last reached 5 Nov 2026.
Category Finance and Payments
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security69
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- No authorisation is required to call this server. Nothing on it is marked destructive, but we can't show that an anonymous caller can only read: full credit needs the server to list at least one tool and every tool to be verifiably read-only. We use a best-effort check of tool names and descriptions to tell read-only tools from tools that change things, so some genuinely read-only tools may not get full credit. Names that start with a read verb (get, list, read, search and similar) and accurate readOnlyHint annotations help. Meet that to earn full credit, or require authorisation. See how to fix → View diagnostics → Partial
- HTTPS enforcement could not be verified: the plaintext port answered with HTTP 405, which proves neither a plaintext path nor enforcement. View diagnostics → Unverified
- The HSTS (Strict-Transport-Security) header is present. View diagnostics → Pass
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability76
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 3878 tokens (~323/item across 12 items; 11 tools + 1 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management13
- Stability observed for 4 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
- Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 11 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 13 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
- Supports UI / widget rendering.Pass
Checks we ran (13)
- TLS certificate
- Authorization
- HSTS header
- DNSSEC
- Transport
- Schema quality
- Stability
- Tool coverage
- Injection markers
- Destructive annotations
- Judged manipulation
- MCP protocol
- Capabilities
Checks we could not complete (1)
These are gaps on our side, not findings about this hosted endpoint. We only credit what we can confirm, so a category made up entirely of them scores 0.
- HTTPS in Endpoint SecurityHTTPS enforcement could not be verified: the plaintext port answered with HTTP 405, which proves neither a plaintext path nor enforcement.
Does not apply to this hosted endpoint (2)
- Supply Chain SecurityScored on package channels only. This is a hosted endpoint, so there is nothing to install or inspect.
- Provenance & TransparencyScored on package channels only. This is a hosted endpoint, so there is nothing to install or inspect.
The score does not measure everything. What the score does not measure →
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 4 Nov 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 7 to 10. That category is still filling its 30-day observation window: 2 days of observed history at the previous scan, 3 at this one. The score rises as the window fills, whether or not the server changes.
- 2 Nov 26 +1
- Stability: unverified → 0.03 ▲ functional
- 1 Nov 26 69
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 5 Nov 2026 · Probed https://mcp.predictionscan.org/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=predictionscan.org | CN=WE1,O=Google Trust Services,C=US | 28 Oct 2026 | 26 Jan 2027 | ECDSA 256 | ECDSA-SHA256 | 39b95b2520ffee6713b26f316bcac0ac |
| SANs: predictionscan.org, mcp.predictionscan.org, *.mcp.predictionscan.org | ||||||
| CN=WE1,O=Google Trust Services,C=US (CA) | CN=GTS Root R4,O=Google Trust Services LLC,C=US | 13 Dec 2023 | 20 Feb 2029 | ECDSA 256 | ECDSA-SHA384 | 7ff31977972c224a76155d13b6d685e3 |
| CN=GTS Root R4,O=Google Trust Services LLC,C=US (CA) | CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE | 15 Nov 2023 | 28 Jan 2028 | ECDSA 384 | SHA256-RSA | 7fe530bf331343bedd821610493d8a1b |
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of mcp.predictionscan.org. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | Trust anchor | 20326, 38696 | 8, 8 | Verified |
| org. | DS published | 725, 26974 | 8, 8 | Verified |
| predictionscan.org. | No DS | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication No authorisation required
The endpoint answered without asking for a token. Anyone who knows the URL can reach it.
| Result | No authorisation required |
|---|---|
| HTTP status | 200 |
| Header | Value |
|---|---|
| strict-transport-security | max-age=31536000; includeSubDomains; preload |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://mcp.predictionscan.org/mcp | Verified | 200 | |
| http (plaintext) | http://mcp.predictionscan.org/mcp | Inconclusive | 405 |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
get_leaderboard Get trader leaderboard ~378
Use this when the user asks who the top Polymarket traders are by profit or by trading volume, or for a Polymarket leaderboard — for example "top Polymarket traders this month", "highest-profit traders this week", "highest-volume traders this week", or "top politics traders by realized profit". Returns up to 25 traders (default 10) from Polymarket.com's public leaderboard: rank, full wallet address, public display name, profit in USD for the period, and dollar trading volume, with a PredictionScan profile link for each trader. Periods: day (since 00:00 UTC), week (7 days), month (30 days) or all-time. Day/week/month profit counts open positions at current prices; all-time profit is realized only. Category boards (sports, politics, crypto, economics, finance, tech, culture, esports, weather, mentions) rank within that category; Polymarket does not publish per-category dollar volume, so it is null there. Read-only; past results do not predict future results. Do not use this to choose a market or trader for the user to put money in; it reports data only. Do not call this when the user asks which market to buy or how to make a profit.
| Name | Type | Req | Description |
|---|---|---|---|
| category | string | – | Limit the board to one market category. Omit for all markets |
| limit | integer | – | How many traders to return (default 10) |
| metric | string | – | Rank by 'profit' (USD gained in the period) or 'volume' (amount traded). Default 'profit' |
| period | string | – | Time window: 'day' (since 00:00 UTC), 'week' (7 days), 'month' (30 days) or 'all' (all-time). Default 'month' |
| Name | Type | Req | Description |
|---|---|---|---|
| category | string|null | yes | – |
| items | array | yes | – |
| kind | string | yes | – |
| metric | string | yes | – |
| period | string | yes | – |
No examples provided.
get_market_flow Get market flow ~324
Use this when the user asks who is buying or selling a Polymarket market, why its odds moved, or where the money is going, for example "who is buying Yes on the Fed October decision", "why did JD Vance's 2028 odds move today", "net buying on Bitcoin $150K this week", or "who holds the most of this market". Takes one market (a slug, a supported market or event link, a condition id, or plain words; for a multi-outcome event it uses the leading open outcome, or a ladder's most-traded open rung, and says so) and a window of 1 to 168 hours (default 24). Returns PredictionScan's flow breakdown from Polymarket.com's public trades: dollars bought and sold and the net per outcome, the trade count, up to 8 largest trades, and up to 5 top holders per outcome with their share counts. Dollar totals count each fill once (its taker side), so they run about half of the two-sided volume Polymarket.com headlines. In very busy markets small fills may be left out so the whole window fits; the text says so. Read-only: flow describes past trades, not where the price will go.
| Name | Type | Req | Description |
|---|---|---|---|
| hours | integer | – | How far back to look, in hours (default 24, max 168 = 7 days) |
| market | string | yes | The market: a slug, a supported market or event link, a condition id, or a few words like 'fed october no change' |
| Name | Type | Req | Description |
|---|---|---|---|
| kind | string | yes | – |
| largest_trades | array | yes | – |
| market_slug | string | yes | – |
| outcomes | array | yes | – |
| title | string | yes | – |
| top_holders | array | yes | – |
| traded_usd | number | yes | – |
| trades_count | integer | yes | – |
| url | string | yes | – |
| window_hours | integer | yes | – |
No examples provided.
get_market_movers Get biggest market moves ~365
Use this when the user asks which Polymarket or prediction-market odds moved the most, what is rising or falling, or what changed today — for example "biggest movers on Polymarket", "which markets moved the most in the last 24 hours", "what odds are dropping in crypto", or "biggest swings in politics today". Returns up to 20 open Polymarket.com markets ranked by their 24-hour change in market-implied probability (points), with the outcome that moved, its probability and 24-hour volume; at most two per event. Optional filters: direction and category. Covers the 300 most-traded markets with at least $10K traded in 24 hours; markets at 1% or below or 99% or above are left out as effectively decided. Excludes individual sports and esports games (single matches and their side markets, live or upcoming) unless the category is sports or esports; futures such as a season or championship winner stay in. Mature topics are left out, and so are "Up or Down" and tweet-count markets without a category. Read-only crowd forecasts, not advice. Do not use this to choose a market or trader for the user to put money in. Do not call this when the user asks which market to buy or how to make a profit.
| Name | Type | Req | Description |
|---|---|---|---|
| category | string | – | Limit to one Polymarket category, e.g. 'politics', 'crypto', 'sports', 'economy'. Omit for all categories |
| direction | string | – | Which moves to include: 'up' (probability rose), 'down' (probability fell) or 'both' (default) |
| limit | integer | – | How many moves to return (default 10) |
| Name | Type | Req | Description |
|---|---|---|---|
| category | string|null | yes | – |
| direction | string | yes | – |
| items | array | yes | – |
| kind | string | yes | – |
No examples provided.
get_market_news Get market news ~313
Use this when the user asks for news, headlines or recent developments behind a prediction market or topic — for example "any news on the Fed October decision?", "what's in the news about Bitcoin ETFs?", "any headlines behind the move in the Fed October odds?", or "latest news on Gavin Newsom 2028". Pass a market (a slug from search_markets, or a supported market or event link) and/or topic words. Returns up to 10 headlines (default 5) from the last 14 days with the outlet, publish time and link, ranked by how many of the market's key names and terms they mention, newest first among equals. Headlines come from PredictionScan's news feed of major outlets (politics, economy, crypto, sports, entertainment): it is not a full web search, returns no article text, and may find nothing for niche markets.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | How many headlines to return (default 5) |
| market | string | – | The market to find news for: a market_slug or event_slug from search_markets (e.g. 'fed-decision-in-october-20260617190323537'), a supported market or event link, or a condition id. Plain words are t… |
| query | string | – | Topic words to search the news for, e.g. 'bitcoin etf', 'fed rate decision', 'us recession'. With a market, keeps only that market's news that mentions these words. |
| Name | Type | Req | Description |
|---|---|---|---|
| items | array | yes | – |
| kind | string | yes | – |
| market_title | string|null | yes | – |
| query | string | yes | – |
No examples provided.
get_market_odds Get market odds ~296
Use this when the user wants the current odds or the details of one specific prediction market or event — for example "what are the odds for the Fed decision in October", "who leads the race for the 2028 Democratic nomination", "show me this market: polymarket.com/event/…", "what are the rules for this market", or "did the 2024 election market resolve, and to what". Accepts a market or event slug, a supported market or event link, a condition id, or the market's question in words. Returns each outcome's market-implied probability from Polymarket.com with its 24-hour change (up to 40 outcomes, mutually exclusive ones ranked, plus the total count), volume, liquidity, end date, status, the resolution rules and source, and the final result for resolved markets. Works for open, closed and resolved markets; when nothing matches it returns up to 3 of the closest open markets instead. Read-only: it cannot place trades, and probabilities are crowd forecasts, not advice. Do not call this when the user asks which market to buy or how to make a profit.
| Name | Type | Req | Description |
|---|---|---|---|
| market | string | yes | The market or event: a slug such as 'fed-decision-in-october-20260617190323537', a supported market or event link, a condition id (0x + 64 hex), or the question in words |
| Name | Type | Req | Description |
|---|---|---|---|
| event | – | yes | – |
| focus | – | yes | The specific market asked about (null when an event was asked about as a whole) |
| found | boolean | yes | – |
| kind | string | yes | – |
| suggestions | array | yes | Closest open markets when the request matched nothing |
No examples provided.
get_price_history Get price history ~362
Use this when the user asks how the odds of a prediction market have changed over time — for example "how have the Fed October odds moved this week", "chart the Bitcoin $150K odds over the last month", "when did Gavin Newsom's 2028 chances jump", or "show the price history of this market". Accepts a market or event slug, a supported market or event link, a condition id, or the question in words, plus an optional outcome name and time range (1d, 1w, 1m, 3m or all; default 1w). Returns the outcome's market-implied probability at the start and end of the range, the change in percentage points, the high and low, and a chart in the card. Prices come from Polymarket.com's order-book history; quiet markets can have gaps, which are left unfilled. For a closed or resolved market the range ends when trading closed. Read-only and informational, not advice.
| Name | Type | Req | Description |
|---|---|---|---|
| market | string | yes | The market or event: a slug such as 'fed-decision-in-october-20260617190323537', a supported market or event link, a condition id (0x + 64 hex), or the question in words |
| outcome | string | – | Which outcome to chart, e.g. 'No change', 'Gavin Newsom', 'Yes' or 'No'. Default: the leading open outcome of a multi-outcome event, or the first outcome (usually Yes) of a single market |
| range | string | – | Time range: 1d, 1w, 1m, 3m, or all (since the first recorded price). Default 1w |
| Name | Type | Req | Description |
|---|---|---|---|
| change_pts | number|null | yes | – |
| end_probability | number|null | yes | – |
| high_probability | number|null | yes | – |
| kind | string | yes | – |
| low_probability | number|null | yes | – |
| market_slug | string | yes | – |
| outcome_label | string | yes | – |
| points | integer | yes | – |
| range | string | yes | – |
| start_probability | number|null | yes | – |
| title | string | yes | – |
| url | string | yes | – |
No examples provided.
get_trader_positions Get trader positions ~277
Use this when the user wants a Polymarket trader's open positions or holdings — for example "what positions does @exampletrader hold", "list all open positions for this 0x wallet", "what is this trader's biggest position", or "which of their positions are up the most". Accepts a full 0x wallet address, a polymarket.com profile URL, an @username or a username. Returns up to 50 open positions (default 20) sorted by current value or by unrealized profit, each with the market, outcome, shares held, average entry and current price in cents, current value and unrealized profit or loss in USD, plus the total number of open positions and the portfolio value. Positions worth under $1 and resolved positions awaiting redemption are left out of the list; the text notes the latter. Read-only public on-chain data.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | How many positions to return (default 20) |
| sort | string | – | 'value' = largest current value first; 'pnl' = largest unrealized gain first. Default 'value' |
| trader | string | yes | The trader: a full 0x wallet address (42 characters), a polymarket.com profile URL, an @username, or a username, e.g. '@exampletrader' |
| Name | Type | Req | Description |
|---|---|---|---|
| items | array | yes | – |
| kind | string | yes | – |
| name | string|null | yes | – |
| total_count | integer | yes | Open positions counted; a floor when total_count_is_floor is true |
| total_count_is_floor | boolean | yes | True when the scan stopped at its 1,000-position cap: the wallet holds at least total_count open positions |
| total_value_usd | number|null | yes | – |
| url | string | yes | – |
| wallet | string | yes | – |
No examples provided.
get_trader_profile Get trader profile ~243
Use this when the user asks about one Polymarket trader or wallet — for example "how is this wallet doing on Polymarket" with a pasted 0x address, "show me @exampletrader's Polymarket stats", "who is this trader" with a polymarket.com profile link, or "what has this trader been trading lately". Accepts a full 0x wallet address, a polymarket.com profile URL, an @username or a username. Returns the public display name, all-time realized profit and dollar volume, current portfolio value, number of open positions, number of markets traded, up to five largest open positions and up to eight most recent trades of $1 or more. A username is matched exactly when possible; otherwise the closest public profile is used and the text says so. Read-only public on-chain data: it does not say who controls a wallet, and past results do not predict future results.
| Name | Type | Req | Description |
|---|---|---|---|
| trader | string | yes | The trader: a full 0x wallet address (42 characters), a polymarket.com profile URL, an @username, or a username, e.g. '@exampletrader' |
| Name | Type | Req | Description |
|---|---|---|---|
| kind | string | yes | – |
| name | string|null | yes | – |
| recent_trades | array | yes | – |
| stats | object | yes | – |
| top_positions | array | yes | – |
| url | string | yes | – |
| wallet | string | yes | – |
No examples provided.
get_trending_markets Get trending markets ~327
Use this when the user asks what is trending, popular, hot or most traded on Polymarket or in prediction markets right now, or wants an overview of the biggest open markets in a category — for example "what's trending on Polymarket", "most popular prediction markets today", "top crypto markets right now", or "what are people trading on in politics". Returns up to 20 open Polymarket.com events with the most trading volume in the last 24 hours, each with up to four outcomes' market-implied probabilities (the leaders, or a price ladder's rungs nearest 50%), 24-hour change and volume. Optional category filter. Events that look settled (an outcome at 99% or more) and games' secondary prop sheets are left out. Excludes individual sports and esports games (single matches, live or upcoming) unless the category is sports or esports; futures such as a season or championship winner stay in. Mature topics, and without a category "Up or Down" and tweet-count markets, are also left out. Read-only crowd forecasts, not certainties or advice. Do not use this to choose a market or trader for the user to put money in. Do not call this when the user asks which market to buy or how to make a profit.
| Name | Type | Req | Description |
|---|---|---|---|
| category | string | – | Limit to one Polymarket category, e.g. 'politics', 'crypto', 'sports', 'economy'. Omit for all categories |
| limit | integer | – | How many events to return (default 8) |
| Name | Type | Req | Description |
|---|---|---|---|
| category | string|null | yes | – |
| items | array | yes | – |
| kind | string | yes | – |
| list_type | string | yes | – |
| query | string|null | yes | – |
No examples provided.
get_whale_trades Get large trades ~387
Use this when the user asks about large or notable recent trades on Polymarket, for example "show me the biggest Polymarket trades today", "any large trades on the Fed decision?", "who made big trades on the 2028 election", or "trades over $50K this week". Scans Polymarket.com's public trade feed and returns up to 50 of the largest fills in the window (default 15), biggest first: time, buy or sell, outcome, dollar size, shares, price in cents, the market and its slug, and the trader's full wallet address and public display name. Optional filters: a minimum dollar size ($1K to $1M, default $10K), one market or event (a slug, a supported market or event link, a condition id, or plain words), and a window of 1 to 168 hours (default 24). Across all markets, fills at 99¢ or more or 1¢ or less (markets that are effectively decided) are left out, and so are individual sports and esports games and mature topics; name a market to see its trades. Each fill is counted once; dollars are shares times price. Read-only and informational: a large trade is not a forecast, and these tools cannot place trades.
| Name | Type | Req | Description |
|---|---|---|---|
| hours | integer | – | How far back to look, in hours (default 24, max 168 = 7 days) |
| limit | integer | – | How many trades to return, largest first (default 15) |
| market | string | – | Limit to one market or event: a slug, a supported market or event link, a condition id, or a few words like 'fed october'. Omit for all markets. |
| min_usd | integer | – | Smallest trade to include, in US dollars (default 10000) |
| Name | Type | Req | Description |
|---|---|---|---|
| items | array | yes | – |
| kind | string | yes | – |
| market_title | string|null | yes | – |
| min_usd | number | yes | – |
| scope | string | yes | – |
No examples provided.
search_markets Search prediction markets ~339
Use this when the user asks about the odds, chances or likelihood of a real-world event, or what Polymarket or prediction markets say about something — for example "what are the odds the Fed cuts rates in October", "Polymarket odds for the 2028 election", "how likely is a US recession in 2026", "chances of Bitcoin hitting $150K this year", "what does the market say about a Ukraine ceasefire", "is there a prediction market on the 2028 Democratic nominee", "will the Fed cut rates in December", or "who will win the 2028 presidential election". Searches open Polymarket.com prediction markets and returns up to 10 closest matches (default 5), each with up to six outcomes' market-implied probabilities (outcomes the query names first, then the leaders, or a price ladder's rungs nearest 50%), 24-hour change and trading volume. For one market's full outcome list, rules and resolution status, use get_market_odds. Read-only: it cannot place trades, and the probabilities are crowd forecasts, not certainties or advice. Do not use this to choose a market or trader for the user to put money in; it reports data only. Do not call this when the user asks which market to buy or how to make a profit.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | How many markets to return (default 5) |
| query | string | yes | The event, person, team, asset or question in plain words, e.g. 'fed rate decision october', 'bitcoin 150k', '2028 presidential election' |
| Name | Type | Req | Description |
|---|---|---|---|
| category | string|null | yes | – |
| items | array | yes | – |
| kind | string | yes | – |
| list_type | string | yes | – |
| query | string|null | yes | – |
No examples provided.
How do I install the PredictionScan MCP server?
PredictionScan is a hosted endpoint at https://mcp.predictionscan.org/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · mcp.predictionscan.org
claude mcp add --transport http jordankarst-predictionscan 'https://mcp.predictionscan.org/mcp'
What is the PredictionScan MCP server?
PredictionScan is an MCP server listed in the public MCP registry as io.github.JordanKarst/predictionscan. Derived prediction-market flow, price changes, trader research and news. 11 read-only tools. This page covers its hosted endpoint (https://mcp.predictionscan.org/mcp).
Is the PredictionScan MCP server safe to use?
PredictionScan scores 71 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the PredictionScan MCP server expose?
PredictionScan exposes 11 tools: search_markets, get_market_odds, get_price_history, get_market_movers, get_trending_markets, and 6 more. Their descriptions and schemas cost roughly 3,611 tokens of context every time the server is loaded.
Does the PredictionScan MCP server require authentication?
No. We connected to PredictionScan without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.
Is the PredictionScan MCP server still maintained?
PredictionScan is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What did VerifyMCP test on the PredictionScan MCP server?
VerifyMCP ran 13 checks on PredictionScan, covering TLS certificate, Authorization, HSTS header, DNSSEC and 9 more. One item could not be completed, a gap on our side rather than a finding about PredictionScan: HTTPS. Supply Chain Security and Provenance & Transparency do not apply to a hosted endpoint, so they were not tested. The score does not measure everything, and the scoring documentation lists what it leaves out.