Trust methodology
Every public listing shows a score from 0 to 100. The weights below are the ones in packages/core/src/trust.ts. An admin override replaces the total and is stored with a reason. It does not hide the fact that a human set it.
| Signal | Max | Rule |
|---|---|---|
| Registry | 30 | 22 for an active official-registry record, plus 8 when the namespace or repository is a known vendor. Deprecated records get 8. Deleted records are not scored as live. |
| License | 10 | 10 for an OSI-style license (MIT, Apache-2.0, BSD, ISC, MPL, GPL, and the rest of the published list). 6 for any other non-empty license. |
| Maintenance | 20 | 20 if the last commit or release was within 30 days, 15 within 90, 10 within 180, 5 within a year, 1 after that. Unknown activity scores 6. |
| Popularity | 20 | Up to 12 from GitHub stars on a log scale that saturates at 5,000. Up to 8 from weekly npm or PyPI downloads, saturating at 100,000. |
| Docs | 10 | 3 when the summary is at least 40 characters, 4 when the description is at least 200, 3 when at least one tool was extracted. |
| Security | 10 | 4 if the repository is not archived, 3 for an HTTPS remote or a package install, 3 when a package version is pinned. |
Labels
80 and above is Excellent, 60 is Good, 40 is Fair, and anything lower is Limited.
What “official” means
Registry-verified means the official registry status is active. Official means the name starts with io.modelcontextprotocol/ or the GitHub login matches a known vendor list. A community server can be registry-verified without being official.