MCP Safety Index
An independent ranking of official MCP servers — hosted and local — scored on security, compliance, and protocol fidelity, so you know what you're really plugging your agents into before you connect it.
Two transports, one question: how much do you expose by connecting it. Hosted and local servers are scored on the same scale — each measured for what it can actually do wrong.
Security
Token/credential handling, authz enforcement, data over-sharing, and supply-chain integrity — how much damage a single tool call, or a single install, can do.
✓ OWASP MCP Top 10 · 5 measured live + 5 LLM-assessed, cited · Hosted: scope creep & over-sharing · Local: package integrity & process blast radius
Access & credentials
How access is granted and the credential is protected — and what it can reach if it leaks.
✓ Hosted: OAuth 2.1 + RFC 8707/9728/7591/7636/9207, walked live · Local: secret storage (keychain vs plaintext env) & blast radius under your user
Protocol fidelity
How faithfully the server implements the spec — capabilities, tool schemas, errors, transport — judged for today and for the July release.
✓ MCP 2025-06-18 & the 2026-07-28 RC · official conformance suite, run as an authorized client (HTTP or stdio)
Get an MCP scored
Drop the server URL and your email — we'll run it through the rubric and send you the results.
Ranking
| Server | Security | Auth | Protocol · 2025-06-18 | Overall |
|---|---|---|---|---|
1 Productboard https://mcp.productboard.com/mcp Hosted MCP ServerOAuth | 82 | 88 | 91 | 87B |
2 ElevenLabs local:elevenlabs-mcp Local · stdioAPI key | 76 | 81 | 91 | 83B |
3 Honeycomb https://mcp.honeycomb.io/mcp Hosted MCP ServerOAuth | 75 | 79 | 94 | 83B |
4 Airtable https://mcp.airtable.com/mcp Hosted MCP ServerOAuth | 76 | 81 | 88 | 82B |
5 Apify https://mcp.apify.com Hosted MCP ServerOAuth | 72 | 75 | 97 | 81B |
6 Make https://mcp.make.com Hosted MCP ServerOAuth | 72 | 81 | 91 | 81B |
7 Mixpanel https://mcp.mixpanel.com/mcp Hosted MCP ServerOAuth | 75 | 78 | 91 | 81B |
8 Stripe https://mcp.stripe.com Hosted MCP ServerOAuth | 75 | 75 | 94 | 81B |
9 Attio https://mcp.attio.com/mcp Hosted MCP ServerOAuth | 81 | 82 | 77 | 80B |
10 Calendly https://mcp.calendly.com Hosted MCP ServerOAuth | 76 | 76 | 88 | 80B |
11 ClickHouse https://mcp.clickhouse.cloud/mcp Hosted MCP ServerOAuth | 78 | 81 | 77 | 79C |
12 PostHog https://mcp.posthog.com/mcp Hosted MCP ServerOAuth | 67 | 75 | 91 | 78C |
13 Semrush https://mcp.semrush.com/v1/mcp Hosted MCP ServerOAuth | 77 | 73 | 83 | 78C |
14 Superhuman https://mcp.mail.superhuman.com/mcp Hosted MCP ServerOAuth | 75 | 67 | 91 | 78C |
15 Vercel https://mcp.vercel.com Hosted MCP ServerOAuth | 74 | 77 | 83 | 78C |
16 Close https://mcp.close.com/mcp Hosted MCP ServerOAuth | 77 | 77 | 77 | 77C |
17 Contentsquare https://api.contentsquare.com/mcp Hosted MCP ServerOAuth | 79 | 73 | 80 | 77C |
18 Peec AI https://api.peec.ai/mcp Hosted MCP ServerOAuth | 72 | 73 | 86 | 77C |
19 Asana https://mcp.asana.com/mcp Hosted MCP ServerOAuth | 75 | 75 | 77 | 76C |
20 Cal.com https://mcp.cal.com/mcp Hosted MCP ServerOAuth | 78 | 73 | 77 | 76C |
21 Linear https://mcp.linear.app/mcp Hosted MCP ServerOAuth | 76 | 74 | 77 | 76C |
22 Lusha https://mcp.lusha.com Hosted MCP ServerOAuth | 76 | 75 | 77 | 76C |
23 Mintlify https://mcp.mintlify.com/mcp Hosted MCP ServerOAuth | 73 | 78 | 77 | 76C |
24 Mobbin https://api.mobbin.com/mcp Hosted MCP ServerOAuth | 74 | 73 | 81 | 76C |
25 Neon https://mcp.neon.tech/mcp Hosted MCP ServerOAuth | 69 | 77 | 81 | 76C |
26 Notion https://mcp.notion.com/mcp Hosted MCP ServerOAuth | 70 | 73 | 85 | 76C |
27 Qonto https://mcp.qonto.com/mcp Hosted MCP ServerOAuth | 79 | 77 | 73 | 76C |
28 Square https://mcp.squareup.com/mcp Hosted MCP ServerOAuth | 78 | 77 | 73 | 76C |
29 Webflow https://mcp.webflow.com/mcp Hosted MCP ServerOAuth | 73 | 73 | 81 | 76C |
30 Apollo https://mcp.apollo.io/mcp Hosted MCP ServerOAuth | 73 | 71 | 80 | 75C |
31 Canva https://mcp.canva.com/mcp Hosted MCP ServerOAuth | 70 | 78 | 77 | 75C |
32 Cloudflare https://mcp.cloudflare.com/mcp Hosted MCP ServerOAuth | 72 | 81 | 73 | 75C |
33 Filesystem (reference) local:@modelcontextprotocol/server-filesystem Local · stdioAPI key | 74 | 73 | 77 | 75C |
34 GitHub https://api.githubcopilot.com/mcp/ Hosted MCP ServerOAuth | 75 | 59 | 91 | 75C |
35 Monday.com https://mcp.monday.com/mcp Hosted MCP ServerOAuth | 71 | 67 | 88 | 75C |
36 Postman https://mcp.postman.com/minimal Hosted MCP ServerOAuth | 76 | 73 | 75 | 75C |
37 Sentry https://mcp.sentry.dev/mcp Hosted MCP ServerOAuth | 73 | 75 | 77 | 75C |
38 ClickUp https://mcp.clickup.com/mcp Hosted MCP ServerOAuth | 74 | 71 | 77 | 74C |
39 Customer.io https://mcp.customer.io/mcp Hosted MCP ServerOAuth | 75 | 78 | 68 | 74C |
40 Fireflies https://mcp.fireflies.ai/mcp Hosted MCP ServerOAuth | 73 | 71 | 77 | 74C |
41 Grafana https://mcp.grafana.com/mcp Hosted MCP ServerOAuth | 70 | 73 | 80 | 74C |
42 Granola https://mcp.granola.ai/mcp Hosted MCP ServerOAuth | 74 | 70 | 77 | 74C |
43 Wix https://mcp.wix.com/mcp Hosted MCP ServerOAuth | 65 | 75 | 81 | 74C |
44 Atlassian https://mcp.atlassian.com/v1/mcp Hosted MCP ServerOAuth | 77 | 62 | 81 | 73C |
45 Resend local:resend-mcp Local · stdioAPI key | 69 | 74 | 77 | 73C |
46 Supabase https://mcp.supabase.com/mcp Hosted MCP ServerOAuth | 72 | 70 | 77 | 73C |
47 Intercom https://mcp.intercom.com/mcp Hosted MCP ServerOAuth | 75 | 65 | 77 | 72C |
48 Perplexity local:@perplexity-ai/mcp-server Local · stdioAPI key | 70 | 74 | 73 | 72C |
49 Clay https://api.clay.com/v3/mcp Hosted MCP ServerOAuth | 70 | 75 | 68 | 71C |
50 Slack https://mcp.slack.com/mcp Hosted MCP ServerOAuth | 75 | 61 | 78 | 71C |
51 Tella https://api.tella.com/mcp Hosted MCP ServerOAuth | 75 | 73 | 60 | 69D |
52 lemlist https://app.lemlist.com/mcp Hosted MCP ServerOAuth | 69 | 75 | 58 | 67D |
53 Koyeb local:@koyeb/mcp-server Local · stdioAPI key | 54 | 62 | 77 | 64D |
54 Browserbase https://mcp.browserbase.com/mcp Hosted MCP ServerBearer Token | 52 | 20 | 72 | 48F |
55 Excalidraw https://mcp.excalidraw.com/mcp Hosted MCP ServerNo Auth | 48 | 0 | 85 | 44F |
