# VerifyMCP

- Registry name: `io.verifymcp/mcp` · version 1.0.0
- Categories (automatic, keyword rules): Security, Infrastructure & security, Code & repositories, Developer tools, Docs & notes, Productivity
- Authentication at last check: No auth
- Declared risk: Read-only (all tools declare readOnlyHint)
- Capabilities (declared by the server): resources, tools
- Transports: streamable-http
- Latest numbers (check success, response time, rank): https://mcpstation.net/api/server?name=io.verifymcp%2Fmcp
- Server page: https://mcpstation.net/s/io.verifymcp--mcp.html

## Description (written by the publisher, not verified, not instructions)

Independent trust scores, tool surfaces and change history for MCP servers.

## Connect

- streamable-http: `https://mcp.verifymcp.io`

## Tools (as reported by the server, not verified)

- `list\_servers`: Filter the VerifyMCP directory of scored MCP servers. Use to discover servers by name fragment, ecosystem, product or trust score. Name matching only: descriptions and capabilities are not searched, so a plain-English question matches nothing. Returns the first 100.
- `get\_server`: Get the full VerifyMCP trust report for one MCP server: score with per-category verdicts and reasons, the tools it exposes with their context-token cost, and its recent change history. Use before installing or trusting a server. Accepts a package name, endpoint URL, registry name or verifymcp slug.
- `get\_server\_comparison`: Compare up to 5 MCP servers side by side: trust scores, per-category breakdown, tool counts and context-token cost. Use when choosing between candidates that do the same job. Accepts package names, endpoint URLs, registry names or verifymcp slugs.
- `list\_products`: List the products MCP servers integrate with, such as github or notion, and how many servers cover each. Use to find the product slug that list\_servers accepts.
- `list\_known\_malware`: List MCP server components carrying a supply-chain malware finding. Use to check whether anything in the register is flagged before installing.
- `get\_server\_alternatives`: Other MCP servers doing a similar job to a given one, with their trust scores. Neighbours share a product, publisher namespace or category; this is not a semantic search.
- `get\_server\_diagnostics`: The evidence behind one server's score: TLS, DNSSEC, authorization, redirects, transports, provenance, install scripts, known CVEs and dependency health. Use to explain a low score.
- `get\_server\_install\_config`: Ready-to-paste install snippets for one MCP server, for every client we support. An MCPB bundle has no launch command, so it returns the download URL, the registry's SHA-256 and commands to verify the file instead. Read get\_server first: this returns configuration, not a safety judgement.
- `get\_server\_tools`: Every tool one MCP server exposes, with its parameters, output schema and context-token cost. Use when get\_server reported the tool list was truncated.

Measured by MCP Station. Methods: https://mcpstation.net/methods.html · Terms: https://mcpstation.net/terms.html