The scoring rubric is a versioned, public contract. Every grade records the rubric_version it was computed under, so scores stay reproducible as the standard evolves. Newest revision first.
v1.1.0PlannedUpcoming
Weight calibration from real findings
The v1 weights are a documented starting point. As the corpus accumulates real findings, the next revision re-balances them against observed severity — and folds in the first dynamic-probe signals (live tool lists) as coverage rises.
Re-weight checks from measured finding distributions, not first principles.
Fold remote/local probe results into injection_surface and version_behavior.
No silent changes: ships as 1.1.0, and old scores keep their 1.0.0 stamp.
v1.0.0Current
Initial public rubric
The first published standard: six static checks, each weighted by how directly a failure enables a real attack, scored 0–100 and mapped to a letter grade. Analysis is static only — the scanner never executes server code — so the rubric is honest about what it can and cannot see.
Six checks spanning injection, supply chain, credentials, permissions, version drift, and transport.
Coverage-aware: unscannable is a distinct state, never a silent skip or a free pass.
Every score is recomputable from its findings — no black box.
Checks & weights
Check
Weight
What it evaluates
injection_surface
25%
Tool descriptions/manifest scanned for instruction-injection patterns (imperatives at the model, hidden text, 'ignore previous', data-exfil URLs).
How the server takes secrets (env vs plaintext config vs hardcoded); secrets appearing in tool schemas.
permission_scope
15%
Declared tools vs. breadth (filesystem, network, exec); flags shell-exec and unbounded filesystem access.
version_behavior
10%
Diff of tool definitions between versions; new permissions or changed descriptions in a patch release (the postmark-mcp class).
transport_config
10%
Remote servers: TLS and auth mode (none/token/OAuth). Local servers: whether the manifest indicates it phones home.
Grade bands
A≥ 90B≥ 75C≥ 60D≥ 40F< 40unscannabledistinct state
The check set and weights are the published contract in @mcp-trust/schema. See the dataset export for the machine-readable data, and the register to browse graded servers.