How this works
Every repo below is cloned fresh and scanned with the current version of
mcp-doctor — the same open-source tool anyone can run with
pip install mcp-server-lint. Two independent scores are shown:
- Quality — tool descriptions, parameter docs, error handling, README/test/license coverage.
- Security — prompt-injection-prone tool descriptions, dangerous dynamic execution, SSRF-prone outbound requests, unsafe deserialization, hardcoded secrets.
This page shows grades only, never raw finding details, for any repo other than mcp-doctor's own. A security grade tells you it's worth a look, not exactly where — publishing exact exploitable specifics about someone else's real security gaps would be irresponsible disclosure. The security check for SSRF in particular is a documented heuristic (flags outbound requests with a non-literal URL) and will read low for servers whose entire purpose is proxying caller-supplied URLs — see the Security checks section of the README for exactly what each check does and how precise it is.
Scored repositories
| Repo | Language | Stars | Tools | Quality | Security | Last scanned |
|---|---|---|---|---|---|---|
| Loading scan results… | ||||||
Get your server scored
Open a PR adding your repo to
leaderboard/repos.json,
or open an issue with the repo link.
It'll show up here after the next scan run.
Already scored and happy with your grade? Copy this into your README:
[](https://vishalhabib99.github.io/mcp-doctor/)