{"$schema":"https://verifymcp.io/schemas/trust-report.json","schemaVersion":1,"license":{"name":"CC BY-NC 4.0","url":"https://creativecommons.org/licenses/by-nc/4.0/"},"generatedAt":"2026-11-05T16:30:51.132Z","url":"https://verifymcp.io/servers/stillmarcus24-stillos-ratings-mcp/stillos-ratings-mcp","markdownUrl":"https://verifymcp.io/servers/stillmarcus24-stillos-ratings-mcp/stillos-ratings-mcp.md","server":{"slug":"stillmarcus24-stillos-ratings-mcp","name":"io.github.stillmarcus24/stillos-ratings-mcp","registryName":"io.github.stillmarcus24/stillos-ratings-mcp","description":"Check an MCP server before you install it — outside-in trust ratings for 7,000+ operators.","registryStatus":"active","deletedAt":null,"statusMessage":null,"liveness":"live","publisher":{"class":"unknown","claimed":false}},"component":{"slug":"stillos-ratings-mcp","type":"mcpb","identifier":"https://github.com/stillmarcus24/stillos-ratings-mcp/releases/download/v1.0.0/stillos-ratings-mcp.mcpb","withdrawn":false,"url":"https://verifymcp.io/servers/stillmarcus24-stillos-ratings-mcp/stillos-ratings-mcp","version":null,"transport":"stdio","scoredAt":"2026-11-05T08:17:42.810Z"},"score":{"total":57,"tier":"low","status":"scored","weekDelta":3,"history":[{"date":"2026-11-05","total":57},{"date":"2026-11-04","total":57},{"date":"2026-11-03","total":56},{"date":"2026-11-02","total":56},{"date":"2026-11-01","total":55},{"date":"2026-10-31","total":55},{"date":"2026-10-30","total":54},{"date":"2026-10-29","total":54},{"date":"2026-10-28","total":53},{"date":"2026-10-27","total":52},{"date":"2026-10-26","total":51},{"date":"2026-10-25","total":52},{"date":"2026-10-24","total":51},{"date":"2026-10-23","total":51},{"date":"2026-10-22","total":51},{"date":"2026-10-21","total":50},{"date":"2026-10-20","total":50},{"date":"2026-10-19","total":49},{"date":"2026-10-18","total":49},{"date":"2026-10-17","total":48},{"date":"2026-10-16","total":48},{"date":"2026-10-15","total":47},{"date":"2026-10-14","total":47},{"date":"2026-10-13","total":43},{"date":"2026-10-12","total":43},{"date":"2026-10-10","total":43},{"date":"2026-10-07","total":43},{"date":"2026-10-05","total":13}]},"categories":[{"name":"Supply Chain Security","score":13,"verdict":"unverified","reasons":["No malware scan is available for this kind of package: the supply-chain vendors we use do not cover it. This is a permanent gap in our coverage, not a finding about the package.","Known CVEs could not be checked: we found no dependency list to check in this bundle: either it runs a compiled binary, whose bundled manifests we do not read, or none of the package.json, requirements.txt, pyproject.toml or uv.lock files it ships for its runtime declares a dependency we can read (a requirements.txt that only points at a setup.py project, a local path, or a nested requirements file we cannot follow counts as none).","No install/post-install scripts declared.","Dependency health could not be checked: we found no dependency list to check in this bundle: either it runs a compiled binary, whose bundled manifests we do not read, or none of the package.json, requirements.txt, pyproject.toml or uv.lock files it ships for its runtime declares a dependency we can read (a requirements.txt that only points at a setup.py project, a local path, or a nested requirements file we cannot follow counts as none)."],"codes":[{"code":"supplychain.malware_inconclusive","args":{"reason":"ecosystem_unsupported"}},{"code":"cve.inconclusive","args":{"reason":"no_manifest_bundled"}},{"code":"installscript.none","args":{}},{"code":"dephealth.inconclusive","args":{"reason":"no_manifest_bundled"}}]},{"name":"Provenance & Transparency","score":45,"verdict":"fail","reasons":["Source repository is publicly reachable at the declared URL.","Provenance check failed: no build-provenance attestation is published.","Clear OSI-approved license (MIT).","Actively maintained (last published 31 days ago).","Disclosure check failed: no security disclosure policy was found in the source repository."],"codes":[{"code":"provenance.repo_verified","args":{}},{"code":"provenance.none","args":{}},{"code":"license.osi","args":{"spdx":"MIT"}},{"code":"maintenance.recent","args":{"age_days":"31"}},{"code":"disclosure.absent","args":{}}]},{"name":"Schema Quality & AI Usability","score":83,"verdict":"fail","reasons":["AI-judged instruction clarity (excellent).","Tool/resource definitions use about 337 tokens (~112/item across 3 items; 3 tools + 0 resources), lean.","Usage-examples check failed: none of the tools include examples."],"codes":[{"code":"schema.ai_quality","args":{"band":"excellent"}},{"code":"schema.footprint_lean","args":{"avg":"112","items":"3","tools":"3","tokens":"337","resources":"0"}},{"code":"schema.examples_absent","args":{}}]},{"name":"Stability & Change Management","score":100,"verdict":"pass","reasons":["No destabilizing schema changes in the last 30 days."],"codes":[{"code":"stability.stable","args":{}}]},{"name":"Tool Coverage","score":100,"verdict":"pass","reasons":["100% of tools have a non-trivial description (not blank, and not just the tool's name).","100% of tool parameters carry a description."],"codes":[{"code":"toolquality.descriptions","args":{"pct":"100"}},{"code":"toolquality.param_docs","args":{"pct":"100"}}]},{"name":"Tool Safety","score":100,"verdict":"pass","reasons":["No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.","We read all 3 captured tool definition(s), and no name or description among them implies an irreversible operation.","An AI judge read all 3 captured unit(s) of tool text and found none that tries to manipulate the model reading it."],"codes":[{"code":"toolsafety.injection_clean","args":{}},{"code":"toolsafety.destructive_none","args":{"tools":"3"}},{"code":"toolsafety.manipulation_clean","args":{"units":"3","judged":"3"}}]},{"name":"Capabilities","score":20,"verdict":"fail","reasons":["Spec-recency check failed: implements MCP spec 2024-11-05; the latest is 2026-07-28."],"codes":[{"code":"protocol.outdated","args":{"latest":"2026-07-28","version":"2024-11-05"}}]}],"inconclusive":["No malware scan is available for this kind of package: the supply-chain vendors we use do not cover it. This is a permanent gap in our coverage, not a finding about the package.","Known CVEs could not be checked: we found no dependency list to check in this bundle: either it runs a compiled binary, whose bundled manifests we do not read, or none of the package.json, requirements.txt, pyproject.toml or uv.lock files it ships for its runtime declares a dependency we can read (a requirements.txt that only points at a setup.py project, a local path, or a nested requirements file we cannot follow counts as none).","Dependency health could not be checked: we found no dependency list to check in this bundle: either it runs a compiled binary, whose bundled manifests we do not read, or none of the package.json, requirements.txt, pyproject.toml or uv.lock files it ships for its runtime declares a dependency we can read (a requirements.txt that only points at a setup.py project, a local path, or a nested requirements file we cannot follow counts as none)."],"malware":[],"components":[{"slug":"stillos-ratings-mcp","type":"mcpb","identifier":"https://github.com/stillmarcus24/stillos-ratings-mcp/releases/download/v1.0.0/stillos-ratings-mcp.mcpb","withdrawn":false,"score":57,"current":true,"url":"https://verifymcp.io/servers/stillmarcus24-stillos-ratings-mcp/stillos-ratings-mcp","markdownUrl":"https://verifymcp.io/servers/stillmarcus24-stillos-ratings-mcp/stillos-ratings-mcp.md"}],"facts":[{"label":"Registry","value":"mcpb"},{"label":"Package","value":"https://github.com/stillmarcus24/stillos-ratings-mcp/releases/download/v1.0.0/stillos-ratings-mcp.mcpb"},{"label":"Transport","value":"stdio"},{"label":"SHA-256","value":"6f048f6a2db6faa962f78aaa7eb87a6c56ded9d33c0fd97ae7fde5bbd3342c9d"}],"install":{"available":true,"bundleSha256":"6f048f6a2db6faa962f78aaa7eb87a6c56ded9d33c0fd97ae7fde5bbd3342c9d"},"tools":[{"name":"check_mcp_server","title":null,"description":"Before installing or trusting an MCP server, check it. Returns an outside-in trust rating for that host from a public census of 7,000+ MCP operators refreshed every 6 hours: percentile grade, rank, five scored dimensions, whether it advertises a machine-payable rail, how many other servers its publisher mass-published and whether it shares a boilerplate tool set with a template fleet, and — critically — any DATED finding that its advertised tool set changed while the version string it serves did not. An unrated host is reported as NOT_RATED with an explicit warning that unobserved is not attested safe. Nothing here is self-reported by the operator and every figure is independently recomputable.","inputs":[{"name":"host","type":"string","required":true,"description":"Hostname, endpoint URL, or registry name — e.g. api.mcp.ai, https://api.mcp.ai/mcp"}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":187},{"name":"list_tool_surface_findings","title":null,"description":"List every MCP operator currently carrying a dated tool-surface finding — a case where the advertised tool set grew while the served version string stayed identical, meaning clients that pinned that version were never asked to re-approve what it now exposes. Includes when each was first observed and a link to free redacted evidence.","inputs":[],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":73},{"name":"compare_mcp_servers","title":null,"description":"Compare up to 10 candidate MCP servers side by side on rating, rank, rail position and open findings — for choosing between alternatives that do the same job. A host we failed to look up is reported as a lookup failure, never as a clean result.","inputs":[{"name":"hosts","type":"array","required":true,"description":"Hostnames to compare (max 10)"}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":77}],"toolsTruncatedAtCapture":false,"diagnostics":{"capturedAt":"2026-11-05T08:17:42.000Z","track":"package","endpoint":null,"declaredUrl":null,"truncated":false,"tls":null,"dnssec":null,"auth":null,"httpsRedirect":null,"transports":[],"provenance":{"outcome":"none","label":"No attestation","reason":"no_attestation","reasonLabel":"No attestation published","discovery":null,"discoveryLabel":null,"sourceRepo":null,"attestationSkipped":null,"attestationSkippedLabel":null},"installScripts":[],"installScriptsTotal":null,"vulnerabilities":[],"vulnerabilitiesTotal":null,"dependencies":null},"mismatches":[],"changelog":{"trackingSince":"2026-10-05","recent":[{"id":"chg_01a1a59f-c074-72dc-b93c-db21a8baa753","kind":"check.verdict","summary":"Stability (0.97 → pass)","materiality":"security","direction":"neutral","scoreDelta":null,"occurredOn":"2026-11-04","url":"https://verifymcp.io/servers/stillmarcus24-stillos-ratings-mcp/stillos-ratings-mcp#chg-chg_01a1a59f-c074-72dc-b93c-db21a8baa753"},{"id":"chg_01a1a59f-c075-7812-bdea-fc3e3a16b3cd","kind":"score.total_changed","summary":"Trust score (56 → 57)","materiality":"functional","direction":"improvement","scoreDelta":1,"occurredOn":"2026-11-04","url":"https://verifymcp.io/servers/stillmarcus24-stillos-ratings-mcp/stillos-ratings-mcp#chg-chg_01a1a59f-c075-7812-bdea-fc3e3a16b3cd"},{"id":"chg_01a19b4f-8732-7cd7-910b-97d0da33e9ce","kind":"score.total_changed","summary":"Trust score (55 → 56)","materiality":"functional","direction":"improvement","scoreDelta":1,"occurredOn":"2026-11-02","url":"https://verifymcp.io/servers/stillmarcus24-stillos-ratings-mcp/stillos-ratings-mcp#chg-chg_01a19b4f-8732-7cd7-910b-97d0da33e9ce"},{"id":"chg_01a19102-d86a-74a5-ba6c-0b17b00ccd41","kind":"check.reverified","summary":"Security disclosure (unverified → fail)","materiality":"functional","direction":"regression","scoreDelta":null,"occurredOn":"2026-10-31","url":"https://verifymcp.io/servers/stillmarcus24-stillos-ratings-mcp/stillos-ratings-mcp#chg-chg_01a19102-d86a-74a5-ba6c-0b17b00ccd41"},{"id":"chg_01a19102-d86b-72f2-adac-15a07e98f5c1","kind":"score.total_changed","summary":"Trust score (54 → 55)","materiality":"functional","direction":"improvement","scoreDelta":1,"occurredOn":"2026-10-31","url":"https://verifymcp.io/servers/stillmarcus24-stillos-ratings-mcp/stillos-ratings-mcp#chg-chg_01a19102-d86b-72f2-adac-15a07e98f5c1"},{"id":"chg_01a18c3a-1f3c-7480-a734-53c114e1bbad","kind":"check.unverifiable","summary":"Security disclosure (fail → unverified)","materiality":"functional","direction":"regression","scoreDelta":null,"occurredOn":"2026-10-30","url":"https://verifymcp.io/servers/stillmarcus24-stillos-ratings-mcp/stillos-ratings-mcp#chg-chg_01a18c3a-1f3c-7480-a734-53c114e1bbad"},{"id":"chg_01a186b3-7312-7d6a-b040-8d36412a03e1","kind":"score.total_changed","summary":"Trust score (53 → 54)","materiality":"functional","direction":"improvement","scoreDelta":1,"occurredOn":"2026-10-29","url":"https://verifymcp.io/servers/stillmarcus24-stillos-ratings-mcp/stillos-ratings-mcp#chg-chg_01a186b3-7312-7d6a-b040-8d36412a03e1"},{"id":"chg_01a18187-dd30-7ea0-941e-e575d298a863","kind":"check.reverified","summary":"Maintenance (unverified → pass)","materiality":"functional","direction":"improvement","scoreDelta":null,"occurredOn":"2026-10-28","url":"https://verifymcp.io/servers/stillmarcus24-stillos-ratings-mcp/stillos-ratings-mcp#chg-chg_01a18187-dd30-7ea0-941e-e575d298a863"},{"id":"chg_01a18187-dd32-7a94-9a4c-3706767b9b07","kind":"score.total_changed","summary":"Trust score (52 → 53)","materiality":"functional","direction":"improvement","scoreDelta":1,"occurredOn":"2026-10-28","url":"https://verifymcp.io/servers/stillmarcus24-stillos-ratings-mcp/stillos-ratings-mcp#chg-chg_01a18187-dd32-7a94-9a4c-3706767b9b07"},{"id":"chg_01a17c61-5fb3-710a-9931-3628cbf4a7d5","kind":"score.total_changed","summary":"Trust score (51 → 52)","materiality":"functional","direction":"improvement","scoreDelta":1,"occurredOn":"2026-10-27","url":"https://verifymcp.io/servers/stillmarcus24-stillos-ratings-mcp/stillos-ratings-mcp#chg-chg_01a17c61-5fb3-710a-9931-3628cbf4a7d5"},{"id":"chg_01a17764-7124-769b-bd59-0ec2923968c2","kind":"check.unverifiable","summary":"Maintenance (pass → unverified)","materiality":"functional","direction":"regression","scoreDelta":null,"occurredOn":"2026-10-26","url":"https://verifymcp.io/servers/stillmarcus24-stillos-ratings-mcp/stillos-ratings-mcp#chg-chg_01a17764-7124-769b-bd59-0ec2923968c2"},{"id":"chg_01a17764-7125-750f-bde2-57a4e81521e5","kind":"score.total_changed","summary":"Trust score (52 → 51)","materiality":"functional","direction":"regression","scoreDelta":-1,"occurredOn":"2026-10-26","url":"https://verifymcp.io/servers/stillmarcus24-stillos-ratings-mcp/stillos-ratings-mcp#chg-chg_01a17764-7125-750f-bde2-57a4e81521e5"},{"id":"chg_01a17229-bc20-711a-8805-21608780f0c7","kind":"score.total_changed","summary":"Trust score (51 → 52)","materiality":"functional","direction":"improvement","scoreDelta":1,"occurredOn":"2026-10-25","url":"https://verifymcp.io/servers/stillmarcus24-stillos-ratings-mcp/stillos-ratings-mcp#chg-chg_01a17229-bc20-711a-8805-21608780f0c7"},{"id":"chg_01a167dc-00ab-7917-9606-c861884f060d","kind":"check.reverified","summary":"Provenance (unverified → fail)","materiality":"security","direction":"regression","scoreDelta":null,"occurredOn":"2026-10-23","url":"https://verifymcp.io/servers/stillmarcus24-stillos-ratings-mcp/stillos-ratings-mcp#chg-chg_01a167dc-00ab-7917-9606-c861884f060d"},{"id":"chg_01a162b7-dac3-7357-a1d1-fbfa1ca81425","kind":"check.unverifiable","summary":"Provenance (fail → unverified)","materiality":"security","direction":"regression","scoreDelta":null,"occurredOn":"2026-10-22","url":"https://verifymcp.io/servers/stillmarcus24-stillos-ratings-mcp/stillos-ratings-mcp#chg-chg_01a162b7-dac3-7357-a1d1-fbfa1ca81425"},{"id":"chg_01a162b7-dac4-7ad6-832e-8d7fa0b127af","kind":"score.total_changed","summary":"Trust score (50 → 51)","materiality":"functional","direction":"improvement","scoreDelta":1,"occurredOn":"2026-10-22","url":"https://verifymcp.io/servers/stillmarcus24-stillos-ratings-mcp/stillos-ratings-mcp#chg-chg_01a162b7-dac4-7ad6-832e-8d7fa0b127af"},{"id":"chg_01a15869-a4d4-7b43-b3f6-70efe7640725","kind":"score.total_changed","summary":"Trust score (49 → 50)","materiality":"functional","direction":"improvement","scoreDelta":1,"occurredOn":"2026-10-20","url":"https://verifymcp.io/servers/stillmarcus24-stillos-ratings-mcp/stillos-ratings-mcp#chg-chg_01a15869-a4d4-7b43-b3f6-70efe7640725"},{"id":"chg_01a14e1f-56b4-732f-8f4b-60c372b56dff","kind":"score.total_changed","summary":"Trust score (48 → 49)","materiality":"functional","direction":"improvement","scoreDelta":1,"occurredOn":"2026-10-18","url":"https://verifymcp.io/servers/stillmarcus24-stillos-ratings-mcp/stillos-ratings-mcp#chg-chg_01a14e1f-56b4-732f-8f4b-60c372b56dff"},{"id":"chg_01a143d3-0f6b-751b-898d-12b75480a588","kind":"score.total_changed","summary":"Trust score (47 → 48)","materiality":"functional","direction":"improvement","scoreDelta":1,"occurredOn":"2026-10-16","url":"https://verifymcp.io/servers/stillmarcus24-stillos-ratings-mcp/stillos-ratings-mcp#chg-chg_01a143d3-0f6b-751b-898d-12b75480a588"},{"id":"chg_01a13985-e3cf-7d47-8c90-58d4910ebf50","kind":"check.reverified","summary":"Stability (unverified → 0.30)","materiality":"functional","direction":"improvement","scoreDelta":null,"occurredOn":"2026-10-14","url":"https://verifymcp.io/servers/stillmarcus24-stillos-ratings-mcp/stillos-ratings-mcp#chg-chg_01a13985-e3cf-7d47-8c90-58d4910ebf50"}],"truncated":true,"feedUrl":"https://verifymcp.io/servers/stillmarcus24-stillos-ratings-mcp/stillos-ratings-mcp/changelog.json"},"links":{"html":"https://verifymcp.io/servers/stillmarcus24-stillos-ratings-mcp/stillos-ratings-mcp","markdown":"https://verifymcp.io/servers/stillmarcus24-stillos-ratings-mcp/stillos-ratings-mcp.md","changelogJson":"https://verifymcp.io/servers/stillmarcus24-stillos-ratings-mcp/stillos-ratings-mcp/changelog.json","changelogRss":"https://verifymcp.io/servers/stillmarcus24-stillos-ratings-mcp/stillos-ratings-mcp.xml","external":[{"label":"Repository","href":"https://github.com/stillmarcus24/stillos-ratings-mcp"}]}}