MCP Trust register — independent MCP-server safety scoring
An independent register of MCP servers, scored safety-first. For MCP servers, "safety" is not chatbot jailbreak-resistance — it's MCP-specific security: what a server can do if hijacked, whether its tool descriptions hide instructions, and whether dangerous tools are reachable without auth. This is an early first cohort; coverage grows as we scan more servers.
Human view: hlido.eu/mcp/ · Machine-readable: /data/mcp-register.json
What we score#
Each server's advertised tools (names, descriptions, input schemas — fetched via tools/list) are analyzed for four red-flag families:
| Family | What it catches |
|---|---|
| Tool poisoning / injection | Hidden or override instructions embedded in a tool description ("ignore previous…", "don't tell the user…", exfiltration hints, invisible/bidi unicode) — the canonical MCP attack. |
| Dangerous capabilities | Tools that can execute shells / code, write or delete files, egress data to arbitrary endpoints, read secrets/env, or mutate databases — the blast radius if the server is hijacked. |
| Auth posture | A mutating / dangerous server reachable with no authentication is elevated. |
| Scope | How many mutating tools a server exposes (broader blast radius). |
Tiers#
Findings deduct from a starting score to a published tier:
| Tier | Meaning |
|---|---|
SAFE | No high-severity red-flags observed in the advertised surface. |
CAUTION | Some capability breadth or minor flags — review before wiring in. |
RISKY | Multiple high-severity capabilities and/or weak auth posture. |
DANGEROUS | Critical red-flags (e.g. tool-poisoning, unauth + dangerous tools). |
not_scanned | Server failed to start or advertised zero tools — not scored as safe (0 findings ≠ safe when nothing was tested). |
Evidence-first, never a bare number. The register publishes the tier and the exact red-flag findings (which tool, which family, why) so the verdict is inspectable. Methodology is open: /methodology/.
Register data#
| Endpoint | What it is |
|---|---|
/data/mcp-register.json | The register: count, counts_by_tier, poisoning_count, and one items[] entry per server (security_tier, security_score, tool_poisoning_detected, dangerous_capabilities[], no_auth, tools_advertised, as_of). |
/data/mcp-register/{slug}.json | Full per-server evidence — every finding with its tool, severity, and reason. |
/data/mcp-allowlist.json | Machine-readable allowlist-candidate feed for org MCP policies (VS Code internal registries, gateway custom registries). Published, conservative criteria: scanned + no tool-poisoning + SAFE/CAUTION. Absence ≠ unsafe — it means not auto-allowlistable yet; see the full register. |
curl -s https://hlido.eu/data/mcp-register.json | jq '.counts_by_tier, .items[0]'Scope & honesty#
- This is static analysis of the advertised tool surface — it flags structural risk, not a runtime exploit proof. A SAFE tier means no red-flags in what the server advertises, not a guarantee.
- The cohort is small and early; absence from the register means "not yet scanned", not "unsafe".
- Independence is the point — Hlido is not a funnel for a paid defense product, and no vendor pays for a score.
On-demand scan (live)#
Name any MCP server you're about to install and get an independent red-flag verdict at the point of use — live since 2026-07-04, three doors over one engine:
| Surface | Use |
|---|---|
scan_mcp MCP tool | Agent-callable on https://hlido.eu/mcp: pass a server URL, npm/PyPI package, or repo. Registered servers answer instantly with evidence; unseen HTTP endpoints get a live static scan in seconds. |
| CLI | npx @hlido/cli scan <server> — same verdict inline; --fail-on risky makes it a CI gate (v0.4.0). |
| GitHub Action | uses: ankitkapur1992-hlido/hlido-public/actions/hlido-mcp-scan@main — scans every MCP server in a repo's .mcp.json / Cursor / VS Code / Claude configs on each PR, sticky comment + gate. |
Honesty by design: a local (stdio) package Hlido hasn't scanned is never executed inline — it's queued for an isolated sandbox scan and reported as not_scanned (typically resolved <24h into the register). An unscanned server is never assumed safe.
MCP safety vs agent safety#
MCP-server safety (this register) is distinct from the per-agent safety_probe dimension, which measures an LLM-backed agent's jailbreak / manipulation resistance. Different threat model, different surface.