The Model Context Protocol (MCP) is one of the most exciting developments in the AI agent ecosystem. It provides a standardized way for AI assistants to connect with external tools - databases, APIs, file systems, and more. But with that power comes a critical question: how do you know which MCP servers to trust?
Update (March 27, 2026): Since this post was originally published, we've expanded our scoring engine from 7 factors to 12, aligned with the CoSAI framework, and scanned over 4,274 MCP servers. This article has been updated to reflect the current state of MCP Shield.
The Trust Problem
As MCP adoption grows, anyone can publish an MCP server. There's no central review process, no mandatory security audit, and no standardized way to evaluate whether a server is safe to connect your AI agent to. This is the gap that the CraftedTrust Registry was built to fill.
"Trust, but verify. Every MCP server, scored."
The 12-Factor Trust Score
We developed a multi-dimensional, CoSAI-aligned scoring system that evaluates MCP servers across twelve critical factors. Each factor contributes to an overall trust score that helps developers and AI agents make informed decisions. Here's what we check:
1. Source Verification
Is the server hosted on a reputable source? We check the repository hosting, the organization behind it, and whether the source code is publicly available for inspection.
2. Permission Scope
What does the server ask for access to? We analyze the declared capabilities - file system access, network requests, database connections - and flag servers that request overly broad permissions.
3. Code Quality Signals
We look for indicators of engineering quality: test coverage, dependency management, documentation completeness, and whether the project follows established security patterns.
4. Dependency Health
Supply chain attacks are one of the biggest threats in modern software. We scan the dependency tree for known vulnerabilities, abandoned packages, and suspicious dependency patterns.
5. Maintainer Reputation
Who maintains the server? We evaluate the development team's track record, contribution history, and responsiveness to security reports.
6. Update Frequency
Stale servers are risky servers. We track how often the codebase is updated, whether security patches are applied promptly, and if the project is actively maintained.
7. Community Validation
Has the broader community vetted this server? We factor in adoption metrics, community reviews, and any third-party security audits.
8. Authentication & Authorization
Does the server implement proper auth? We evaluate whether the server uses OAuth, API keys, or other authentication mechanisms - and whether it enforces least-privilege access patterns for connected agents.
9. Transport Security
We verify TLS configuration, certificate validity, and whether the server enforces encrypted connections. Servers transmitting tool results over unencrypted channels are flagged immediately.
10. Input Validation & Injection Resistance
MCP servers receive prompts and parameters from AI agents. We test for prompt injection vectors, command injection, and other input-handling weaknesses that could allow an agent to be weaponized through a compromised server.
11. Data Handling & Privacy
What data does the server log, store, or transmit? We evaluate data retention policies, PII handling, and whether the server complies with baseline privacy expectations. Servers that exfiltrate conversation data are immediately flagged.
12. Compliance Alignment
We map each server's posture against five major compliance frameworks: CoSAI, OWASP AI Security, EU AI Act, NIST AI RMF, and AIUC-1. This gives enterprises a clear view of regulatory readiness before connecting agents to third-party servers.
From scores to public profiles
MCP Shield doesn't just score servers - it provides a badge service that server maintainers can embed in their documentation. This creates a positive feedback loop: maintainers are incentivized to improve their security posture, and users get a visual indicator of trust before connecting.
The current public registry does not sell certification. Profiles instead show what kind of evidence is available, whether a public endpoint was reached, how old the result is, and how much confidence that evidence supports.
What the registry does not do
The active registry does not use x402 payments, sell premium trust verification, or turn a score into an authorization decision. It provides a public signal that teams can use alongside their own review and operating controls.
Registry coverage changes over time
The live coverage count is shown on the registry itself because indexed records, recent live checks, and reviewed profiles are different things. The public API and MCP endpoint make those signals available programmatically without claiming that every indexed server received the same depth of review.
The MCP ecosystem is moving fast. Trust evidence needs to stay honest about what was observed. Explore the current CraftedTrust registry to see the active product.