Skip to content

The trust layer for MCP servers

Know which MCP servers you can trust.

Thousands of MCP servers, none of them vetted. Vouchity scores every server on the signals that matter — how it's maintained, how widely it's trusted, what it can do to your machine — so you never wire an unvetted tool into your agents again.

320

Servers scored

63

Average Trust Score

269

Carrying a risk flag

11

Categories covered

Synced from the official MCP registry 2 months ago — every score recomputed on each sync.

Why this matters

Most MCP servers ship completely unvetted

Anyone can publish to the registry. Nobody checks who's maintaining it, what it can touch on your machine, or whether it's still alive.

55% ship with no license

176 servers in the registry declare no license at all — no legal permission to use them and nothing Vouchity (or you) can verify about how they're governed before install.

27% grade D or F

85 servers combine stale maintenance, broad host permissions or a missing auth requirement into a score that should give you pause.

269 carry an active risk flag

No-auth remote endpoints, archived repos, deprecated packages, injection-shaped tool text — Vouchity surfaces the exact flag, and keeps watching after you install.

How it works

A score, not a guess

We continuously check every server

Every server in the official MCP registry is re-fetched on a schedule — its repository, its npm package, its license, its activity — so the data never goes stale.

We score five independent signals

Maintenance, adoption, transparency, security and provenance — each weighted and combined into one 0–100 Trust Score, with the evidence for every point shown on the server page.

We alert you when it degrades

Watch the servers you depend on. If a maintainer goes quiet, a repo gets archived or a package is deprecated, you find out before your agent does.

Built for agents, not just humans

Let your agent vet its own tools

An agent shouldn't blindly install whatever MCP server a prompt points it at. Vouchity publishes every Trust Score over a clean JSON API and an llms.txt, so a model can check a server before it ever runs its code.

# Vet a server before installing it

GET https://www.vouchity.com/api/v1/servers/ai-foura-mcp

{
  "name": "MCP",
  "trust": {
    "score": 86,
    "grade": "A",
    "verdict": "Trusted",
    "flags": []
  },
  "transports": ["streamable-http","stdio"],
  "install": "npx @fouradata/mcp",
  "remote_endpoint": "https://mcp.foura.ai/mcp"
}

FAQ

Good questions

What is Vouchity?

Vouchity is a public registry for the Model Context Protocol. Every server published to the official MCP registry gets a transparent, 0–100 Trust Score computed from real GitHub, npm and registry signals — so you can tell which servers are safe to wire into your agents before you install them.

How is the Trust Score calculated?

Five weighted signals — maintenance, adoption, transparency, security and provenance — each backed by citable evidence (last commit date, license, download counts, declared auth, and more). A signal that can't be verified from public metadata is excluded from the score entirely, never guessed. See the methodology page for the full breakdown.

Is it free?

Yes. Browsing the full registry, the leaderboard, categories and risk watch is free with no account required. Creating a free account lets you build a watchlist and get alerted when a server you depend on changes grade.

Can AI agents use Vouchity?

Yes — that's a first-class use case. Vouchity exposes a public Trust API and an llms.txt so a model can look up a server's score, grade and risk flags before it decides whether to install or invoke it.

Stop installing MCP servers blind.

Browse the full Trust Score registry free. Create an account to build a watchlist and get alerted the moment a server you depend on changes grade.