How we check MCPs

What the scan checks

The scan is deterministic: no model, no judgement calls. The same input always produces the same result, and you can reproduce it yourself.

• Whether the source is public. A server with no open repository cannot be read — so it cannot be trusted by default.
• Which environment variables the server asks for. We extract them from the published package README — config blocks, env tables and export FOO= lines.
• Whether those look like secrets. A key counts as sensitive if it contains TOKEN, KEY, SECRET, PASSWORD, API, AUTH, CREDENTIAL, PRIVATE, ACCESS, CONNECTION, DSN, MNEMONIC, SEED, PASSPHRASE, or points at an external host.
• When the package was last published. An abandoned server is flagged stale — it is not getting patches.
• Who publishes it. First party or third party (see Verified below).

How the risk level is derived

"Trusted" = first-party publisher or open source. The formula is exactly this:

• unknown — not scanned yet. We say so instead of painting it green.
• low — asks for no secrets and is trusted.
• medium — either asks for secrets, or is not trusted.
• high — asks for secrets and is not trusted.

What the scan does not do

This section matters more than the previous one. We do not claim these:

• we do not execute the server in a sandbox or observe its runtime behaviour;
• we do not run SAST, and we do not scan dependencies for known CVEs;
• we do not verify artifact signatures or build an SBOM;
• we do not guarantee the server will not exfiltrate your data.

The scan answers "what will this server ask me for, and can I read its code" — not "is it safe". That difference is the whole point.

How Verified is earned

The badge means exactly one of two things:

• the server is published by the first party — the company whose product it talks to (GitHub → GitHub MCP, Notion → Notion MCP);
• the server passed a manual review: open source, no eval/exec over user input, no committed secrets, a legible list of outbound calls.

Verified is not for sale and is not granted for listing. It is not a code audit and it is not a guarantee.

Reporting a vulnerability

Email [email protected]. We reply within 72 hours and keep you updated until it is closed.

In scope: unyly.org, gateway.unyly.org, the public API, the Connect widget, the CLI.
Out of scope:vulnerabilities inside the catalogued MCP servers themselves (report those to the server's author), automated scanner output with no demonstrated exploit, DoS.

Safe harbor.We will not pursue good-faith research: do not touch other people's data, do not degrade the service, give us reasonable time to fix — and there will be no claim.

The machine-readable version lives at /.well-known/security.txt (RFC 9116).