VerifyMCP

io.verifymcpPublished by verifymcp.ioOfficial publisherv1.0.0Updated Oct 24, 2026

Independent trust scores, tool surfaces and change history for MCP servers.

VerifiedStreamable HTTPWeb executableSecurity & Monitoring

Overview

AI-generated overview

Provides independent trust scores, tool surfaces, and change history for MCP servers so an assistant can assess them.

What you can do
VerifyMCP is a remote MCP server that supplies independent trust scores, tool surfaces, and change history for MCP servers. It is meant to help an assistant look up how a given MCP server is rated and what tools it exposes, and to see how that has changed over time. The manifest lists no tools, so the exact operations are not documented here.
When to use it
Worth adding when you are evaluating or comparing MCP servers and want an independent view of their trust scores, exposed tools, and change history before installing them. Less useful if you already have a trusted internal registry or do not need third-party assessments.
Requirements
A remote streamable HTTP endpoint at The manifest declares no authentication, environment variables, or headers, and no local runtime or package is needed.
Before you install
The manifest declares no credentials, but the service is a third-party endpoint, so queries and any data you send go to that provider. Trust scores are third-party assessments and should not be treated as guarantees. No tools are listed, so verify what it actually does before relying on it.

Installation

In SourceWeft

  1. Open VerifyMCP in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/io.verifymcp%2Fmcp/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "verifymcp": {
      "type": "http",
      "url": "https://mcp.verifymcp.io/"
    }
  }
}

README

This repository has no README.

Tools

9

list_servers

List MCP servers

Filter the VerifyMCP directory of scored MCP servers. Use to discover servers by name fragment, ecosystem, product or trust score. Name matching only: descriptions and capabilities are not searched, so a plain-English question matches nothing. Returns the first 100.

ParameterssortquerytypesscoredproductmaxScoreminScore

get_server

Get MCP server trust report

Get the full VerifyMCP trust report for one MCP server: score with per-category verdicts and reasons, the tools it exposes with their context-token cost, and its recent change history. Use before installing or trusting a server. Accepts a package name, endpoint URL, registry name or verifymcp slug.

Parameterscomponentidentifierrequired

get_server_comparison

Compare MCP servers

Compare up to 5 MCP servers side by side: trust scores, per-category breakdown, tool counts and context-token cost. Use when choosing between candidates that do the same job. Accepts package names, endpoint URLs, registry names or verifymcp slugs.

Parametersidentifiersrequired

list_products

List products

List the products MCP servers integrate with, such as github or notion, and how many servers cover each. Use to find the product slug that list_servers accepts.

Parametersquery

list_known_malware

List known malware

List MCP server components carrying a supply-chain malware finding. Use to check whether anything in the register is flagged before installing.

Parametersstatus

get_server_alternatives

Find alternative MCP servers

Other MCP servers doing a similar job to a given one, with their trust scores. Neighbours share a product, publisher namespace or category; this is not a semantic search.

Parametersidentifierrequired

get_server_diagnostics

Get MCP server diagnostics

The evidence behind one server's score: TLS, DNSSEC, authorization, redirects, transports, provenance, install scripts, known CVEs and dependency health. Use to explain a low score.

Parameterscomponentidentifierrequired

get_server_install_config

Get MCP server install config

Ready-to-paste install snippets for one MCP server, for every client we support. An MCPB bundle has no launch command, so it returns the download URL, the registry's SHA-256 and commands to verify the file instead. Read get_server first: this returns configuration, not a safety judgement.

Parameterscomponentidentifierrequired

get_server_tools

List an MCP server's tools

Every tool one MCP server exposes, with its parameters, output schema and context-token cost. Use when get_server reported the tool list was truncated.

Parameterscomponentidentifierrequired

Version history

1
  1. v1.0.0LatestSep 16, 2026

Score

75% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts

    Declare a GitHub repository with a README, or serve resource_documentation in the OAuth protected-resource metadata.

  • License10 pts

    Declare a license in the repository or the registry entry.