MCPgrade grades MCP servers by security checks
LankyStruggle7605 · reddit · 2026-07-20
A new tool, MCPgrade, scans MCP servers with six static security checks and grades them from A to F before agents trust them.
It checks for:
- prompt injection in tool descriptions
- package provenance
- secret handling
- permission scope
- version changes
- transport/auth
The author ran it on about 17,700 servers. The rough distribution was A 325, B 10,761, C 2,503, D 356, F 38, and 3,712 could not be inspected enough to grade. Most servers landed at B because the scanner only uses static analysis, so it cannot see runtime behavior or a live local tool list unless the server is executed.
There is also a dispute flow for owners who think a grade is wrong.
More from coding & agent
- Ben Bajarin: Frontier AI is becoming the enterprise cyber-defense stack — BenBajarin · 2026-10-26
- Building AI bots on raw APIs? Devs say models are 'dumb without the harness' — madeofAjala · 2026-10-26
- HarnessMM cuts agent tokens per task by up to 88% while raising success rates — omarsar0 · 2026-10-26
- Microsoft demos intent-classifying agents built with Copilot App and Foundry, deployable across Teams and Outlook — marlene_zw · 2026-10-26
- Looking for a wearable mic with best battery life that feeds recordings to personal agents via MCP — altryne · 2026-10-26
- The identity crisis in software engineering: multiagent systems demand a new problem set — rakyll · 2026-10-26