Money never buys rank or a grade.

1. Organic rank and grades are computed the same way for every listing. No payment, partnership or friendship changes them.
2. If we ever sell placement, it will be labeled “Sponsored”, shown apart from organic results, and never on security or comparison data.
3. We publish how grades and ranking work (this page), and we change it in public with a date.
4. Listings link to their sources. We index facts and the publisher's own description; we do not copy other directories' curated content.

MCP servers come from the official MCP Registry. Skills come from public GitHub repositories that contain SKILL.md files. Both are refreshed daily. Publishers can claim a listing to add details, and anyone can submit what we are missing.

Plugins, harnesses, agents, models and infrastructure arrive in November 2026, with the same rules.

Freshness (live now) comes from the most recent release or commit we can see:

• A · Active in the last 30 days
• B · Active in the last 90 days
• C · Active in the last 6 months
• D · Active in the last year
• F · No activity for over a year

A hosted server with no public code can change without publishing a new version, so an old registry date alone does not earn it a low grade; it shows a dash until uptime checks start in November 2026.

Security (from November 2026) will combine dependency vulnerability scans, secret detection, install-hook and obfuscation checks, prompt-injection and tool-poisoning checks on SKILL.md files and tool descriptions, and a record of the permissions each version asks for. Until a listing is scanned it shows a dash, not a grade. The full method will be published here before the first grade appears.

Grades are automated assessments, not guarantees. Always read what a tool can do before you give it access to your data.

Results are ordered by how well they match your search, then by a score built from five parts:

• Security, 30%: the security grade. Until scans run, a publisher whose domain the MCP Registry verified gets a small, temporary edge.
• Adoption, 25%: GitHub stars and package downloads.
• Freshness, 20%: the freshness grade.
• Reviews, 15%: verified installer reviews, once they exist. Neutral until then.
• Documentation, 10%: a real description, a repository, install instructions and docs.

Publishers with very large numbers of near-identical listings are ranked lower while we build duplicate detection. Abandoned projects rank lower over time.

• Indexed. Found automatically from a public source. Not yet claimed by its publisher.
• Claimed. The publisher proved ownership through GitHub or DNS.
• Verified. Claimed, passed automated scans, and has real contact details.
• Audited. Passed a manual security review.

Today every listing is Indexed. Claiming through GitHub or DNS opens in November 2026.

Reviews come only from verified installers (the logged-in CLI or an established GitHub account), pass automatic checks and, unless the author is install-verified and every check is clean, a person. They feed the 15% rating weight through an average that stays neutral until a listing has 5 published reviews. Review guidelines

Use Report a problem on any listing, or the submit form. Security reports get a human reply within 24 hours. A listing we confirm as malicious comes down immediately, and we keep a public log of removals.

If you found a vulnerability in someone else's tool, we will help reach the maintainer privately before anything is published.