MCPgrade grades MCP servers by security checks
LankyStruggle7605 · reddit · 2026-07-20
A new tool, MCPgrade, scans MCP servers with six static security checks and grades them from A to F before agents trust them.
It checks for:
- prompt injection in tool descriptions
- package provenance
- secret handling
- permission scope
- version changes
- transport/auth
The author ran it on about 17,700 servers. The rough distribution was A 325, B 10,761, C 2,503, D 356, F 38, and 3,712 could not be inspected enough to grade. Most servers landed at B because the scanner only uses static analysis, so it cannot see runtime behavior or a live local tool list unless the server is executed.
There is also a dispute flow for owners who think a grade is wrong.
More from coding & agent
- Cheaper OpenAI Agents API alternative: sandbox service undercutting E2B by 46% — airesearch12 · 2026-09-11
- His agent kill switch ran for months before he found it was wired to nothing — AnvilandCode · 2026-09-11
- Kernel's Browser Agents Can Now Pay Online Using Aliases, Never Touching Card Data — jeff_weinstein · 2026-09-11
- OpenAI opens up agent sandboxes: BYO or pick from Cloudflare, E2B, Modal, Vercel and more — threepointone · 2026-09-11
- SocialCrawl MCP lets agents search Reddit, YouTube, TikTok, X with one API key — dooddyman · 2026-09-11
- Astra builds a surprisingly polished Catan game in three.js, reusing past UI and 3D assets — FinanceYF5 · 2026-09-11