Every MCP server here has a grade.
MCP servers get handed live credentials and told to act on their own. Directories index them; nobody grades them. These 434 were pulled from GitHub by stars, scanned against a published method, and scored. No signup, no queue — the grades are below.
Ranked by grade, not by popularity.
Most directories rank by stars. These rank by how the code actually scored.
434 servers shown
Nothing matches that. Try a shorter search.
Limits, stated plainly.
These grades come from static analysis of public source. No live endpoint was probed. Automated scanning cannot prove the absence of vulnerabilities, and a clean grade is not a safety guarantee — a server can pass every check and be compromised tomorrow through a dependency or a maintainer account takeover.
Findings that look like credentials are excluded when they appear in test fixtures, because test keys are not live keys. Anything still flagged is held back from publication until the maintainer has been contacted. If you maintain a server here and a finding is wrong, tell us and we will re-scan and correct it.
Use this as one input to your own review, not a replacement for it.