MCPgrade grades MCP servers by security checks
LankyStruggle7605 · reddit · 2026-07-20
A new tool, MCPgrade, scans MCP servers with six static security checks and grades them from A to F before agents trust them.
It checks for:
- prompt injection in tool descriptions
- package provenance
- secret handling
- permission scope
- version changes
- transport/auth
The author ran it on about 17,700 servers. The rough distribution was A 325, B 10,761, C 2,503, D 356, F 38, and 3,712 could not be inspected enough to grade. Most servers landed at B because the scanner only uses static analysis, so it cannot see runtime behavior or a live local tool list unless the server is executed.
There is also a dispute flow for owners who think a grade is wrong.
More from coding & agent
- AI agents are starting to strain code hosting platforms — craigsdennis · 2026-07-21
- Async OPD distillation doubles throughput while matching synchronous math accuracy — _lewtun · 2026-07-21
- Omnigent 0.6.0 adds Claude Code imports, Slack approvals and desktop apps — matei_zaharia · 2026-07-21
- Google appears to have quietly shipped Gemini 3.6 Flash, with lower pricing and better agentic scores — xiaohu · 2026-07-21
- Open-source CLI audits AI tools, MCP configs, and agent skills on local machines — Initial-Copy332 · 2026-07-21
- Coding agents feel less stressful when the 5-hour limits are temporarily removed — iamrobotbear · 2026-07-21