Skip to content
ProtocolProbe
Explore

Method · record checks, version 1

Record checks

Nine yes-or-no questions answered from public records only, for every server in the official MCP registry. Each server page shows “N of M record checks met” with every check and its reason, and so do the API and the README badge. No tool is called, and the count is not a safety rating.

How the count works

  • Met and not met are counted. M is the number of checks that apply and could be read, so it differs between servers: a remote server with no package can have at most 5.
  • Does not apply: the fact cannot exist for this kind of server (a remote server ships no package). Listed, never counted.
  • Not checked: our lookup could not run or failed. Listed, never counted, and never turned into “not met”.
  • There is no letter grade and no weighting: every check counts the same, and the page shows which ones were met.

The nine checks

1. Registry entry is active and says how to run it

  • Met: The entry is active and lists a package or a remote address.
  • Not met: The registry marks it deprecated, or it lists no package and no remote address, so a client cannot run it.
  • Source: MCP registry entry

2. Source repository link opens

  • Met: The linked GitHub repository is public.
  • Not met: The link returns HTTP 404 (missing or private), the entry gives no link, or the link field is empty.
  • Not checked: The link is not on GitHub, or GitHub did not return it to us.
  • Source: GitHub API

3. Repository is not archived

  • Met: The repository is not archived.
  • Not met: The owner archived it (read-only, no further changes).
  • Does not apply: No public GitHub repository.
  • Source: GitHub API

4. Code pushed to the repository in the 90 days before our check

  • Met: The last push was within 90 days before our check.
  • Not met: The last push was more than 90 days before our check, or the repository is archived.
  • Does not apply: No public GitHub repository.
  • Not checked: GitHub gave no last-push date.
  • Source: GitHub API

5. Repository publishes a security policy (SECURITY.md)

  • Met: A SECURITY.md is published where GitHub reads it.
  • Not met: No SECURITY.md in those places.
  • Does not apply: No public GitHub repository.
  • Not checked: We did not read this repository's policy.
  • Source: GitHub

6. Package names its licence with a standard (SPDX) identifier

  • Met: The npm/PyPI package names its licence with an SPDX identifier (for example MIT, Apache-2.0).
  • Not met: No licence, or one that is not a standard identifier (for example "SEE LICENSE IN LICENSE", "Proprietary").
  • Does not apply: Remote servers and packages outside npm/PyPI.
  • Not checked: The package could not be read (for example it is no longer on npm/PyPI).
  • Source: npm / PyPI

7. The version the registry lists can be installed and is not withdrawn

  • Met: The version the registry lists exists on npm/PyPI and is not withdrawn (a newer version may exist).
  • Not met: The package or the listed version is missing, or the listed version is deprecated (npm) or yanked (PyPI).
  • Does not apply: Remote servers and packages outside npm/PyPI.
  • Not checked: No stable release to compare against.
  • Source: npm / PyPI

8. npm package carries build provenance (attestation)

  • Met: The npm package carries a build attestation naming its source repository and workflow.
  • Not met: Signed by npm, but no build attestation.
  • Does not apply: Remote servers, PyPI packages (PyPI has no npm-style attestation) and other ecosystems.
  • Not checked: npm did not return the package.
  • Source: npm

9. No known critical or high advisory in the package or its dependencies

  • Met: No known critical or high advisory in the listed version or its resolved dependency tree.
  • Not met: OSV lists an advisory for the listed version, or its dependencies carry a critical or high advisory.
  • Does not apply: Remote servers and packages outside npm/PyPI.
  • Not checked: We could not resolve its dependency tree.
  • Source: OSV.dev, npm audit

What the checks do not say

They describe the records around a server, not what its code does. A server can meet all nine and still behave badly, and a missing SECURITY.md or build attestation says nothing about how a server behaves. Facts are as of the check date shown on each page and are refreshed with each data reload. If a fact about your server is wrong, write to us and we will re-check it.

Where you see them

  • Every server page, in the Record checks section, and as a chip at the top.
  • Leaderboards, including the list of servers that meet all nine.
  • The API: recordChecks in /api/v1/servers/<name> (API documentation).
  • The README badge: /api/v1/badge/<name>, which shows “N of M record checks met”.