MCPRadar Security Leaderboard

MRS (MCPRadar Risk Score) rates MCP server security on a 0–10 scale where 0 = safe and 10 = critical.

MCPRadar's versioned MRS-v1 score is ((base + AARS) / 2) × ThM. base is the severity-weighted MEDIUM+ findings (critical×10, high×7, medium×4) over the tool count. AARS is the agentic capability layer — a tool's blast radius (arbitrary execution, browser control, file writes, network egress, secret access) — so a powerful server is non-A even with no CVE and a clean schema. ThM is an environmental multiplier (insecure transport). Capability can only raise the score, never discount a real finding. The result is clamped to 10.0 and mapped to a letter grade:

Low-severity findings (informational lint, such as a string parameter with no length constraint) are listed on a server's detail page but do not affect its grade — otherwise nearly every server would fail on documentation-level noise.

Servers marked pending / not scanned carry no grade. They appear at the bottom of the table and are excluded from the averages; a never-scanned server is never shown as a clean pass.

A 0.0–0.9   B 1.0–2.9   C 3.0–4.9   D 5.0–6.9   F 7.0–10.0

Hash: SHA-256 of the alphabetically sorted tool names, used to detect tool-list changes across scans (drift detection).

Scope: schema = tool schemas analyzed, fingerprint = tool signature comparison, cve = known-vulnerability matching against OSV/GitHub Advisory.

Capability weights (AARS) — each tool is tagged by blast radius; the server's AARS is the highest present plus a small breadth bonus:

Weights are ordinal (exec > browser > db-write > fs-write > secrets > egress > read > none), matching the MCPRadar MRS-v1 principle that autonomy and tool-use amplify a baseline. Full justification: scoring-model.md.

Detection confidence — every finding carries a separate true-positive likelihood: 0.9 exact/AST/CVE, 0.7 heuristic, 0.5 inferential. Shown per finding on each detail page.

Limitations — read this.

• Every rule is opinionated. The checks are heuristics: they produce both false positives and false negatives. A grade is a signal, not a verdict.
• This is not a one-size-fits-all measure of security. A high-capability server (shell, browser) is designed to be powerful — a low grade reflects blast radius, not bad code.
• Most findings are static (schema + source + dependencies). We do not execute tools, so runtime-only behaviour is out of scope.
• Dependency CVEs are reachability-unknown and shared across the ecosystem, so they are capped at grade C and never fail a server alone.
• A server that could not be launched or fetched is marked incomplete, never graded a clean A.

Found a false positive? Open an issue — every finding is disputable.

Reproduce any row — the scan is deterministic and open source:

uvx mcpradar scan "npx -y <package>" -t stdio --json

or scan straight from a package with no local checkout: uvx mcpradar deps npm:<package>.

Open a GitHub issue with the public source, package, and suggested launch command. A maintainer reviews every request before running an isolated scan; submitting a request never executes the server automatically.

Open Scan Request Issue ↗