@mcpgrade/mcp

An MCP server that lets your agent check the security grade (A–F) of any MCP server in the registry — before it installs or trusts it. Powered by mcpgrade.dev.

Static-analysis grades across six checks: prompt-injection surface, supply chain, credential hygiene, permission scope, version drift, and transport/auth. No key, no signup — it reads the public grade feed.

Install

Add it to your MCP client config. It runs via npx, so there's nothing to install first.

Claude Desktop / Claude Code / Cursor / Windsurf (mcpServers block):

{
  "mcpServers": {
    "mcpgrade": {
      "command": "npx",
      "args": ["-y", "@mcpgrade/mcp"]
    }
  }
}

Tools

• check_mcp_server(name) — look up a specific server's grade, score, publisher, and a link to the full report. Accepts a full id (com.stripe/mcp) or a partial name (stripe).
• search_mcp_servers({ query?, category?, min_grade?, limit? }) — find graded servers, ranked best-grade-first. e.g. "database servers graded B or above".

Example — ask your agent "is the stripe MCP server safe?" and it can call check_mcp_server and read back the grade + report link.

Notes

• Grades are static analysis only — they reflect what's observable in the published package and manifest, not runtime behaviour or intent. Each grade is disputable; the report link shows the findings behind it.
• Data refreshes daily as mcpgrade re-crawls the registry. The server caches the feed for an hour.

Full register, methodology, and per-server reports: https://mcpgrade.dev