The Model Context Protocol (MCP) is one of the most exciting developments in the AI agent ecosystem. It provides a standardized way for AI assistants to connect with external tools - databases, APIs, file systems, and more. But with that power comes a critical question: how do you know which MCP servers to trust?
Update (March 27, 2026): Since this post was originally published, we've expanded our scoring engine from 7 factors to 12, aligned with the CoSAI framework, and scanned over 4,274 MCP servers. This article has been updated to reflect the current state of MCP Shield.
The Trust Problem
As MCP adoption grows, anyone can publish an MCP server. There's no central review process, no mandatory security audit, and no standardized way to evaluate whether a server is safe to connect your AI agent to. This is the gap that MCP Shield was built to fill.
"Trust, but verify. Every MCP server, scored."
The 12-Factor Trust Score
We developed a multi-dimensional, CoSAI-aligned scoring system that evaluates MCP servers across twelve critical factors. Each factor contributes to an overall trust score that helps developers and AI agents make informed decisions. Here's what we check:
1. Source Verification
Is the server hosted on a reputable source? We check the repository hosting, the organization behind it, and whether the source code is publicly available for inspection.
2. Permission Scope
What does the server ask for access to? We analyze the declared capabilities - file system access, network requests, database connections - and flag servers that request overly broad permissions.
3. Code Quality Signals
We look for indicators of engineering quality: test coverage, dependency management, documentation completeness, and whether the project follows established security patterns.
4. Dependency Health
Supply chain attacks are one of the biggest threats in modern software. We scan the dependency tree for known vulnerabilities, abandoned packages, and suspicious dependency patterns.
5. Maintainer Reputation
Who maintains the server? We evaluate the development team's track record, contribution history, and responsiveness to security reports.
6. Update Frequency
Stale servers are risky servers. We track how often the codebase is updated, whether security patches are applied promptly, and if the project is actively maintained.
7. Community Validation
Has the broader community vetted this server? We factor in adoption metrics, community reviews, and any third-party security audits.
8. Authentication & Authorization
Does the server implement proper auth? We evaluate whether the server uses OAuth, API keys, or other authentication mechanisms - and whether it enforces least-privilege access patterns for connected agents.
9. Transport Security
We verify TLS configuration, certificate validity, and whether the server enforces encrypted connections. Servers transmitting tool results over unencrypted channels are flagged immediately.
10. Input Validation & Injection Resistance
MCP servers receive prompts and parameters from AI agents. We test for prompt injection vectors, command injection, and other input-handling weaknesses that could allow an agent to be weaponized through a compromised server.
11. Data Handling & Privacy
What data does the server log, store, or transmit? We evaluate data retention policies, PII handling, and whether the server complies with baseline privacy expectations. Servers that exfiltrate conversation data are immediately flagged.
12. Compliance Alignment
We map each server's posture against five major compliance frameworks: CoSAI, OWASP AI Security, EU AI Act, NIST AI RMF, and AIUC-1. This gives enterprises a clear view of regulatory readiness before connecting agents to third-party servers.
From Scores to Certifications
MCP Shield doesn't just score servers - it provides a badge service that server maintainers can embed in their documentation. This creates a positive feedback loop: maintainers are incentivized to improve their security posture, and users get a visual indicator of trust before connecting.
Our certification program is now live. Certified servers undergo a deeper manual review, receive a premium trust badge, and their certification is anchored as an on-chain EAS attestation on Base - making it independently verifiable by anyone, including other AI agents. Certification can be paid for programmatically via agent-to-agent USDC payments through Stripe or Coinbase.
x402: Pay-Per-Request Trust Verification
We've also introduced x402 micropayments, allowing AI agents to pay per-request for trust verification using USDC on Base. This means trust scoring can be integrated natively into agentic workflows without requiring human intervention or pre-negotiated contracts.
4,274+ Servers and Growing
With over 4,274 servers scanned and growing daily, MCP Shield is the largest independent trust registry for the MCP ecosystem. Our public API and 6 MCP tools (available at /api/v1/mcp) allow developers and agents to programmatically check trust scores before connecting - making trust verification a native part of the agent development workflow. MCP Shield now serves as the public trust plane of CraftedTrust Platform, feeding certification, audit, and governance workflows across the broader service stack. We're also listed on the official MCP Registry as com.craftedtrust/mcp-shield.
The MCP ecosystem is moving fast. Trust verification needs to move faster. Explore MCP Shield to see the registry in action, or visit craftedtrust.com/platform for the full CraftedTrust platform.