Methodology
RULESET v2026.1 · LAST UPDATED 2026-08-09
§1Why isn't the open MCP registry enough?
The MCP registry API is open — anyone can pull the full server list in an afternoon. That's not the gap. The gap is judgment: independent audits have found the majority of MCP servers carry serious, unaddressed security issues, and the existing open-source scanners that try to catch them run false positive rates high enough to be unusable at scale. aimcplist exists to close that specific gap — not by listing more servers, but by grading 500 of them credibly.
§2What does aimcplist actually grade?
Every server is scored independently on four dimensions — never collapsed into one opaque number.
§3Are aimcplist's grades reproducible?
Every grade is produced by a deterministic, versioned ruleset — no LLM makes a grading decision. The ruleset version that produced a given grade is always shown on the listing itself, and re-running the same ruleset against the same inputs always produces the same grade. When the ruleset changes, the version number changes, and every affected grade is recomputed and dated.
§4What is aimcplist's false-positive rate?
Independent audits have measured false-positive rates as high as ~78% from existing YARA-based MCP scanners. Publishing an honest, measured, and lower number here is the single strongest trust signal we can offer — which is exactly why we won't publish a placeholder.
§5Which MCP servers get human-reviewed?
Automated-only grading inherits the false-positive problem it's meant to differentiate against. The top 100 servers by adoption get a human review on top of automated scanning — that review is version-locked: it's tied to a specific tool-definition content hash and package version. If either changes, the human-verified badge is automatically stripped, the grade reverts to Automated Only, and the server is re-queued for a fresh review. A stale human review is treated as worse than no human review at all.
§6Which scanners does aimcplist use?
aimcplist does not build its own scanning engine from scratch. Servers are checked by Cisco's mcp-scanner, an open-source scanner run in isolated, ephemeral containers. The design supports reconciling findings across multiple independent scanners with a most-conservative-wins rule — if scanners disagree, the more cautious outcome is what gets recorded and disclosed, never averaged or hidden — but for now, Safety scores reflect a single scanner's assessment, disclosed honestly as such on every listing rather than presented as a two-scanner reconciliation that isn't actually happening. A second independent scanner — likely snyk-agent-scan (Invariant Labs' original mcp-scan, now maintained under Snyk's name) — is planned; it was pulled from the pipeline after real testing showed it returning the same failure for every server regardless of actual safety, which would have silently corrupted every grade rather than improving it.
§7Can a server game its grade?
Publishing our full ruleset and using public open-source scanners is a deliberate trust choice — and it has a real cost: a motivated author can read exactly what's checked and write code that evades it while remaining genuinely unsafe. We mitigate this with a small number of non-public or rotating checks layered on top of the published baseline. We're disclosing that this exists, not what it is — publishing the specific evasion-resistant checks would defeat their purpose.