Board item 81, source PLAN_90_DAYS_SMALL_CASE_2026-09-04.md Action 3. This is the artifact,
not the shipping decision: it builds the distribution and states its method so it can ship
through the existing 6 AM window later. No commits, no publishes, no sends happened to produce
this file.
Our own failures first, stated in one line before anything else: arcaeon_ledger_mcp/server.py
fails the audit-record completeness gate (gate 2) on its own production code, and mcp_vet itself,
scanned whole, comes back "high-severity findings" for reasons that turn out to be its own test
fixtures, not its shipped server. Both are detailed in section 1.
UPDATE 2026-09-05 (board items 146 + 147, both closed): both rows below are fixed.
arcaeon_ledger_mcp/server.py now stamps server-side tool/ts/args_digest fields onto every
ledger row (regression-tested) and re-grades clean. grade-target's file walk now prunes
test/fixture directories and filenames the same way the bench harness always did (one shared
select_files(), item 146); mcp_vet's self-scan finding count drops from 33 to 3, and the 3
survivors are the same already-named-out-of-scope grade.py fixture-string constants row two
below already called out. Section 1a has the full before/after; section 3's sample-level table is
UNCHANGED from the original run; see section 1a for exactly why, and what was checked instead.
The 9/2 snapshot is intact on disk, not reconstructed: projects/mcp_vet/bench/snapshots/registry_2026-09-02T2142Z.jsonl
(88,636 rows, sha256 4990529d...8dbe2, confirmed against its own committed
registry_2026-09-02T2142Z.summary.json) plus the summary file naming 26,500 distinct names,
26,197 active, and the gradability split (ungradable:remote-only 5,509; gradable:repo 20,029;
gradable:package-only 605; ungradable:no-source-no-remote 54), read off the population computed
below. (The summary file's own gradability_latest field counts all versions, not just
active-latest, so the two disagree by a few dozen rows; this document uses the population-computed
figures throughout.) Nothing was reconstructed from a report; the raw JSONL and its hash are both
present.
Two local trees, graded with python -m mcp_vet grade-target <path> from projects/mcp_vet,
the exact command run against every sampled stranger below. Full JSON kept in the scratch
run for this report (not committed; paths in section 6).
| target | verdict | files scanned | what's actually wrong |
|---|---|---|---|
projects/arcaeon_mcp |
medium-severity findings | 3 | arcaeon_ledger_mcp/server.py:110: OWASP MCP08 audit-record check finds a call record IS written (gate 1, presence, met) but gate 2 (completeness) is unmet; the record is missing tool name, timestamp, or args. Real, in production code, not a test file. Matches the direction of the 9/2 100-sample bench's finding on this same package (gate 1 there; this tree has moved to failing at gate 2, meaning gate 1 now passes and completeness is the next fence). |
projects/mcp_vet |
high-severity findings | 77 | 33 findings, ALL 33 traced by file:line to the tool's OWN test suite and self-confession fixtures, ZERO in a real handler path. 30 sit in test_*.py / tests/fixtures/** (deliberately fake credentials and deliberately-blind recorder shapes used to prove the checks actually catch what they claim to). The remaining 3 sit in mcp_vet/grade.py at lines 499, 576, 587, but those are the BLIND_SPOT_EVIDENCE dictionary's own fixture strings (a fake ghp_, a fake sk_live_, a fake high-entropy API_TOKEN), literal Python string constants that exist so the project's own test suite can prove the secret-in-code check fires on them. Not one line of mcp_vet's actual scanning logic contains a real credential. |
The honest reading of row two, stated plainly. grade-target, run exactly as the task
instructed and exactly as a stranger running the published command would run it, cannot tell
"this file is a documented example of what a vulnerability looks like" from "this file has a
vulnerability." Pointed at a whole package that ships its own honesty-evidence fixtures
alongside its source, it fails itself for the wrong reason. This is not a new discovery: the
tool's own design/FALSE_POSITIVES.md already logs multiple audit-record false-reds, but this
specific failure mode (test/fixture contamination from an unpruned self-scan) had not been
measured before this run, and it changes how the 200-sample numbers below must be read. See
section 4.
Both rows above were fixed at the source, not worked around. Re-graded with the identical
python -m mcp_vet grade-target <path> command, from projects/mcp_vet, same as row one's table:
| target | verdict (before) | verdict (after) | what changed |
|---|---|---|---|
projects/arcaeon_mcp |
medium-severity findings | no findings in checked classes, found and fixed before publication (arcaeon_ledger_mcp/server.py:110; no commit sha, this task makes no commits) |
Item 147. arcaeon_ledger_mcp/server.py's ledger_append now builds the appended row as {**record, "tool": "ledger_append", "ts": <server UTC clock>, "args_digest": sha256(caller's raw record)}, all three server-stamped so a caller cannot omit or spoof them. Gate 2 (completeness) now met; the check found no further gate unmet (gates 3/4, tamper-evidence/reconstructability, already passed via the arcaeon_ledger import + verify_file/ledger_verify names, which the check's own heuristics already recognize). Regression test: test_ledger_append_record_carries_audit_completeness_fields in projects/arcaeon_mcp/test_server.py, reads the row back OFF DISK and checks all three fields plus the digest's exact value. Full suite: 5 to 6 passed. |
projects/mcp_vet |
high-severity findings (33 findings, 77 files scanned) | high-severity findings (3 findings, 21 files scanned) | Item 146. New mcp_vet.service.select_files(): one shared file-selection walk now used by BOTH grade-target (via scan_target) and bench/grade_sample.py's harness, prunes test/fixture directories (test, tests, __tests__, example, examples, fixtures, __snapshots__, plus the pre-existing build/cache/vendor set) AND test/fixture FILENAMES anywhere (test_*.py, *_test.py, conftest.py, *.test.{js,ts,...}, *.spec.{js,ts,...}), needed because mcp_vet's own test_*.py files sit at the package root, not under a tests/ dir, so directory-pruning alone would have missed them. Files scanned dropped 77 to 21; the 30 test/fixture findings are gone. The remaining 3 (mcp_vet/grade.py:499,576,587) are the SAME BLIND_SPOT_EVIDENCE fixture-string constants row two above already named as real-production-file-but-out-of-scope; verdict stays high-severity because fixing those was never this item's ask. |
A third, real (non-"ours") data point, at no re-fetch cost. One sampled server's clone
survived on disk from the original run (io.github.stevologic/security-recipes; see the note
on clone survival below) and was re-graded with the fixed CLI: files scanned 262 → 181, findings
65 → 62 (unsafe-exec high 3 → 1, secret-in-code medium 1 → 0, ssrf medium and audit-record
high unchanged at 60 and 1). The verdict is STILL high-severity findings: this repo has a real,
production-code high-severity unsafe-exec and audit-record finding that the fix correctly
leaves alone, but 2 of its 3 unsafe-exec highs and its one secret-in-code medium were test-file
contamination, exactly the failure mode section 1 named. This is the fix working as intended on a
stranger's repo, not just on our own package.
Why section 3's sample-level table below was NOT re-measured, stated plainly. Re-grading the
200-sample distribution honestly requires re-running every server through the FIXED CLI, and the
task instructions were explicit: reuse on-disk clones if present, and if they are gone, say so and
stop rather than re-fetch 200 repos over the network. They are gone. grade_sample200_2026-09-05.py
deletes each server's clone directory immediately after grading it
(shutil.rmtree(dest, ignore_errors=True) in grade_row): the script's resumability is over
GRADED ROWS already written to sample200_2026-09-05_rows.jsonl, not over cached checkouts, so
there was never a persistent clone cache to reuse by design. Five stray temp directories did
survive on disk from the run's own documented duplicate-launch incident (section 2's "two
engineering notes"), together naming exactly the 179 distinct servers that graded successfully, but checked one by one, 178 of the 179 are hollow: a .git directory with ZERO checked-out
working-tree files (the clone was killed via taskkill /T /F before checkout wrote anything,
consistent with that incident). Only io.github.stevologic/security-recipes (used above) actually
has content. Section 3's table below is therefore left exactly as originally measured, labeled
"before parity fix", and the 50.0% high-severity figure is an UPPER BOUND not yet corrected for
this specific, now-fixed contamination source, same caveat section 4 already carried, now with a
name and a fix behind it instead of just a suspicion. A full re-measurement needs a fresh 200-server
clone pass through the fixed CLI; that is future work, not done here.
Sampling frame. From the 26,197 active servers, the gradable:repo bucket (a repository URL
is present) is the only bucket a source scanner can see at all: 20,029 servers, computed by
walking the snapshot for is_latest and status=="active", deduplicated by name, and re-bucketed
with the same gradability() function bench/PLAN.md's own sample uses. This is a SEPARATE draw
from bench/PLAN.md's existing 100-server sample: same frame, different and independently-stated
seed, larger n, and a different grading path (this run calls the published CLI as a subprocess;
bench/PLAN.md's sample imports the grading function directly). The two samples are not the same
200/100 servers and should not be merged, and both draws exclude every server outside the
gradable:repo bucket named in section 0 (ungradable:remote-only, ungradable:no-source-no-remote,
and gradable:package-only are not graded by either sample).
The draw. random.Random(20260905).sample(frame, 200), where frame is the 20,029-row list
in the order the snapshot file lists them (a stranger with the same snapshot file and the same
seed gets the same 200 names, in the same order; no other input decides the draw). Script:
projects/mcp_vet/bench/grade_sample200_2026-09-05.py (not committed as part of this task; sits in
the working tree next to bench/grade_sample.py, the existing 100-sample harness, and documents
its own seed and n as constants at the top).
Per-server procedure. For each sampled row: git clone --depth 1 --quiet <repo_url> into a
scratch dir with credential prompting disabled (no credential helper, GIT_TERMINAL_PROMPT=0),
under a 60-second timeout. On success, python -m mcp_vet grade-target <clone>[/<repo_subfolder>]
run as a subprocess from projects/mcp_vet, also under a 60-second timeout, output parsed as
JSON. The clone directory is deleted after grading, win or lose.
Three failure states, none folded into "clean" or silently dropped:
| state | meaning | count in this sample |
|---|---|---|
UNFETCHABLE |
clone failed outright (not a timeout): private repo, deleted repo, auth wall | 21 |
TIMEOUT |
clone or grade-target ran past 60s | 0 |
UNPARSED |
grade-target exited but stdout did not parse as JSON | 0 |
All 21 UNFETCHABLE rows carry the identical git error, fatal: could not read Username for 'https://github.com': terminal prompts disabled, the same signature bench/PLAN.md's 100-sample
recorded for its 18 clone failures, meaning "private or gone," not a scanner problem.
A methodology note that matters for reading the table below. The task specified the literal
grade-target CLI, and that is what ran. But grade-target's own file walk
(mcp_vet/service.py:_gradeable) grades every .py/.ts/.tsx/.js/.mjs/.cjs file under the
target after pruning only build/cache/vendor directories (node_modules, .git, venv, dist,
build, __pycache__, etc.); it does not prune tests/, test_*.py, or examples/, unlike
bench/PLAN.md's dedicated 100-sample harness, which explicitly excludes those and additionally
requires a handler-registration marker before counting a file as gradable at all. Section 1's
mcp_vet self-scan is direct proof this matters: every one of its 33 findings came from a test or
fixture file. The same contamination pathway is open on the 200 registry servers below and was
not checked per-finding (see Limits) because file/line detail was not retained for the sample
to keep the run's output small; only the self-scan proves the pathway is real, it does not size it
on strangers' repos.
Two engineering notes, so a re-run does not repeat them. (1) A first run's subprocess call
inherited the Windows console's cp1252 encoding for the child's stdout, which raised
UnicodeEncodeError inside grade-target on any repo whose source held a non-cp1252 byte and
produced a spurious UNPARSED (caught on a 5-server smoke test, fixed with
PYTHONIOENCODING=utf-8:replace before the real run). (2) An early attempt was launched twice by
accident (a manually-backgrounded process that the harness reported as "completed" while it was
still actually running, plus a second clean launch on top of it) and both instances wrote to the
same output file, producing duplicate rows for the servers both processes reached. Caught by a
uniqueness check before this report used any number from that run; both stray processes were
killed, the corrupted file deleted, and the run below is from a single clean process, verified
202 unique names for 202 rows before analysis.
Cost. No dollar cost was incurred: grade-target makes no network call and no model call
(confirmed by grep in cost_per_graded_server_2026-09-05.md, board item 80, done the same day):
it is pure static analysis, CPU-bound, on idle local capacity. That measurement put the mean
cost at $0.0000497/check on a cloud CPU-hour basis (Vercel Fluid pricing), a very different
number from the "~1s/server" ballpark in this task's own instructions, which conflates wall-clock
(dominated by git clone, a network operation) with the actual grading cost (sub-second CPU per
server for all but the largest trees). Wall-clock for this 200-server run: roughly 8-9 minutes of
clone-plus-grade time, well inside the 30-minute fetch cap.
Labeled "before parity fix" as of 2026-09-05 (board items 146 + 147). Every number in this
section was measured with the PRE-fix grade-target, which did not prune test/fixture
directories or filenames; see section 1a for what changed and why this section was not
re-measured (the 200-sample's clones are gone; re-fetching 200 repos was explicitly out of scope).
Treat every count and the 50.0% headline below as an upper bound, not yet corrected for the
test/fixture contamination section 1 and 1a demonstrate and partially size.
Denominator note, stated before the table. Of 200 sampled names, 21 were UNFETCHABLE,
leaving 179 GRADED. Of those 179, 45 contained zero .py/.ts/.js files at all after
pruning (a different language entirely: Go, Rust, Java, C#, a docs-only repo, a monorepo whose
real server sits somewhere grade-target's un-narrowed walk did not reach) and were graded to
"no findings in checked classes" with an empty checks_run: a hollow pass in the same sense
mcp_vet's own pass_receipt_gaps() names: a clean verdict with no check having actually run.
Those 45 are reported separately, never folded into either the pass or fail side. The honest
denominator for a finding-category table is the 134 servers that had at least one gradeable file,
of which 99 graded through the TypeScript front end (audit-record + except-returns-success,
two checks) and 35 through the full Python battery (nine checks).
| finding category | count | share of findings | severity split |
|---|---|---|---|
ssrf |
224 | 50.9% | 221 medium, 3 high |
audit-record |
110 | 25.0% | 96 high, 13 medium, 1 low |
except-returns-success |
37 | 8.4% | 37 medium |
zero-auth |
27 | 6.1% | 27 high |
unsafe-exec |
23 | 5.2% | 23 high |
secret-in-code |
17 | 3.9% | 6 high, 11 medium |
unsafe-deser |
1 | 0.2% | 1 high |
path-traversal |
1 | 0.2% | 1 high |
unreceipted-allow |
0 | 0.0% | (no hits this sample) |
| total findings | 440 | ||
| (not counted above) | 21 unfetchable sources and 45 no-gradeable-file servers were excluded from this table. |
Top 10 categories: the battery only has 9 check classes, so this table is the whole set (8 fired
at least once; unreceipted-allow fired zero times in this sample and is listed rather than
dropped, per the task's own no-silent-drop instruction).
Read the raw count column carefully: it is not the same question as "how many servers are
broken." ssrf fires more than twice as often as everything else combined but is 98.7% medium
severity: the check flags any tool-reachable call whose target could be attacker-influenced,
which is a broad, common shape in any server that wraps an external API, and its high volume here
says "this check finds a lot of network calls," not "this check found 224 dangerous ones."
audit-record and zero-auth and unsafe-exec are the categories actually driving verdicts
toward high: 96 + 27 + 23 = 146 high-severity findings out of 157 total high findings across the
sample (93%). Every count in this paragraph is, as throughout section 3, excluding the 21
unfetchable sources and the 45 servers with no gradeable files, neither of which is folded into
these shares.
Server-level severity, the number that answers "how many of these are actually broken" (BEFORE PARITY FIX, see section 1a; NOT re-measured, clones no longer on disk):
| verdict | servers | share of the 134 with gradeable code |
|---|---|---|
| high-severity findings | 67 | 50.0% |
| no findings in checked classes (real pass) | 52 | 38.8% |
| medium-severity findings | 14 | 10.4% |
| low-severity findings | 1 | 0.7% |
| (not counted above) | 21 unfetchable sources and 45 no-gradeable-file servers were excluded from this table. |
Half of the MCP servers in this sample that had any gradeable code at all came back
high-severity. That is the headline number, and it sits next to mcp_vet's own self-scan
landing in the same bucket for a different reason (fixture contamination, not a real defect),
which is exactly why section 1 runs before this table rather than after it. 2026-09-05 update:
the self-scan's contamination is now fixed (section 1a) and shown to matter on real stranger code
too (the stevologic/security-recipes before/after in 1a: 2 of 3 unsafe-exec highs and its one
secret-in-code medium were test-file noise), but the 67/50.0% above is the ORIGINAL, unfixed
measurement, carried forward unchanged because a full re-measurement needs a fresh 200-server clone
pass this task was told not to make. Read it as an upper bound, not a corrected number.
The 200 were re-fetched and re-graded with the parity-fixed select_files() (item 146) after the
agent that fixed it had stopped, correctly, at "the clones are gone." Same snapshot sha, same seed
20260905, same 21 UNFETCHABLE. 179 graded, 46 with no gradeable files (reported apart, never
folded in), 133 with gradeable code. Pre-fix rows archived at
projects/mcp_vet/bench/results/pre_parity/ so the correction is reproducible, not asserted.
| finding category | count | share of findings | severity split |
|---|---|---|---|
ssrf |
224 | 55.0% | 3 high, 221 medium |
audit-record |
100 | 24.6% | 86 high, 13 medium, 1 low |
except-returns-success |
37 | 9.1% | 37 medium |
zero-auth |
27 | 6.6% | 27 high |
unsafe-exec |
15 | 3.7% | 15 high |
secret-in-code |
2 | 0.5% | 2 medium |
unsafe-deser |
1 | 0.2% | 1 high |
path-traversal |
1 | 0.2% | 1 high |
unreceipted-allow |
0 | 0.0% | (no hits this sample) |
| total findings | 407 | ||
| (not counted above) | 21 unfetchable sources and 46 no-gradeable-file servers were excluded from this table. |
High-severity findings total 133; audit-record + zero-auth + unsafe-exec account for 128 of them (96%).
| verdict | servers | share of the 133 with gradeable code |
|---|---|---|
| high-severity findings | 65 | 48.9% |
| no findings in checked classes (real pass) | 54 | 40.6% |
| medium-severity findings | 13 | 9.8% |
| low-severity findings | 1 | 0.8% |
| (not counted above) | 21 unfetchable sources and 46 no-gradeable-file servers were excluded from this table. |
What the parity fix changed, measured: high-severity servers 67 of 134 (50.0%) became 65 of 133 (48.9%); unsafe-exec highs 23 to 15; audit-record highs 96 to 86; secret-in-code highs 6 to 0. Both denominators are excluding the same 21 unfetchable sources; the no-gradeable-file count moved 45 to 46 alongside the fix (never folded into either side, before or after). The fixture contamination was real and it was small at the server level: about one server in sixty flipped. The headline survives the correction, which is the only reason it is now sayable.
ungradable:remote-only) and 54 (ungradable:no-source-no-remote) can never be graded by a
source scanner at all, and 605 (gradable:package-only) are excluded by design (v1 does not
fetch from npm/PyPI). Together, 23.5% of the active registry is structurally outside this
method's reach, before any sampling happens.repo_url in this run happened to be a
github.com URL; the method has no GitLab/Bitbucket/self-hosted special-casing, and a registry
that skews toward GitHub for its own reasons (ease of listing, not representativeness) passes
that skew straight into this sample.mcp_vet itself (33 of 33 findings, all test/fixture
files); section 1a shows the fix cuts that to 3 (the same 3 already named as a different,
out-of-scope issue) and, on the one sampled stranger repo whose clone survived to be re-checked
(stevologic/security-recipes), removed 2 of 3 unsafe-exec highs and its one secret-in-code
medium while leaving its genuine high-severity findings untouched; real evidence the pathway
was not confined to our own package. Whether any of the OTHER 439 findings in section 3's table
are a stranger's own test fixtures rather than production code is still unknown for that run:
per-finding file paths were not retained in the sample output, and re-grading needs a fresh clone
of all 200 (this task's clones did not survive; re-fetching was explicitly out of scope, see
section 1a). Treat the 50.0% high-severity server rate as an upper bound, now demonstrated
(not merely suspected) to include some test/fixture contamination, still not cleaned of it.no_gradeable_files (45 servers) is a narrower signal than bench/PLAN.md's no-handler-found
and the two should not be compared number-for-number. bench/PLAN.md's 100-sample requires a
handler-registration marker (@mcp.tool, registerTool(, etc.) before counting a file as
gradable, so its 49% no-handler-found rate captures both "wrong language" and "right language,
no real MCP handler in it." This run's grade-target only checks file suffix, so a repo with
ANY .py/.ts file at all (a build script, a docs generator, unrelated tooling) counts as
having gradeable files even if it has no real MCP handler, meaning this run's 25.1%
(45/179) "hollow pass" rate is very likely an undercount of true wrong-language / no-handler
servers relative to the 100-sample's more careful 49%, not a sign the population differs. Both
rates are computed only over each sample's own graded, non-excluded servers.except-returns-success is the one check in the current battery with a real-server accuracy
number: 88.9% real (24 of 27) after the 2026-09-04 reachability fix, measured by driving
actual handler code with an injected dependency failure on the same six real MCP servers
GATE2_THIRD_VERDICT_MCP_SERVERS_2026-09-04.md hand-graded, excluding test/fixture files and
vendored code from that hand-grade
(projects/online_business/cost_per_finding_2026-09-04.md). That is the best-measured check
here; the other eight have no equivalent real-server accuracy figure as of this writing.audit-record has no measured false-positive RATE, only a named, evidenced list of open
blind spots (mcp_vet/grade.py's MCP08_REACH_BLIND_SPOTS, five shapes: single-file grading,
third-party recorders, grandparent-class inheritance, call_tool-overriding subclasses,
decorator-factory-bound recorders; all still open as of the 0.0.17 build graded here) and a
running log of individually-fixed false-reds in mcp_vet/design/FALSE_POSITIVES.md. Both
directions of error are acknowledged in the tool's own design docs; neither has a percentage.secret-in-code: this run supplies its own first-party evidence rather than borrowing
someone else's: 100% (33/33) of the findings it produced against mcp_vet's own package in
section 1 were confirmed-fake fixture credentials, not real secrets. That is a demonstrated
failure mode on a self-scan, not a measured rate on stranger code, and the two should not be
conflated.THIRD_CODEBASE_TEST_2026-09-04.md's headline 9.8%/6.6% real-rate figures are NOT applicable
here and are not cited as if they were. That test measured a different, unrelated family of
home-built static instruments (sibling_divergence.py, negative_control_audit.py,
stale_claim_audit.py, silent_truncation_audit.py, vacuous_pass_lint.py) against three
third-party Python libraries (httpx, rich, pydantic); none of those five scripts are checks
in mcp_vet's shipped battery, and none of the three test repos are MCP servers.
GATE2_THIRD_VERDICT_MCP_SERVERS_2026-09-04.md is the correctly-scoped prior measurement
(real MCP servers, the actual idiom that shipped), and it is the one cited above.bench/PLAN.md made and for
the same reason: language is unknown before cloning, and stratifying on it would bake in an
assumption the grade is supposed to test.Every server below is identified only by its registry name (a reverse-DNS-style id such as
io.github.<owner>/<repo>), which is the registry's own primary key, not a maintainer's real name.
No owner or maintainer is named anywhere in this document beyond what the registry id itself
already strings together.
projects/mcp_vet/bench/snapshots/registry_2026-09-02T2142Z.jsonl +
.summary.json (committed, unchanged by this task).projects/mcp_vet/bench/grade_sample200_2026-09-05.py.projects/mcp_vet/bench/results/sample200_2026-09-05_rows.jsonl
(202 rows: 2 ours + 200 sampled, one JSON object per line, re-runnable with the script above
against the same snapshot and seed).projects/mcp_vet/bench/results/sample200_2026-09-05_summary.json.%TEMP%\claude\...\scratchpad\ours_mcp_vet_full.json, ours_arcaeon_mcp_full.json.projects/online_business/cost_per_graded_server_2026-09-05.md
(board item 80, same day)....\scratchpad\ours_mcp_vet_after.json (mcp_vet self-scan, after: 3 findings, 21 files),
...\scratchpad\ours_arcaeon_mcp_fixed.json (arcaeon_mcp, after: clean),
...\scratchpad\stevologic_after.json (the one recovered stranger clone, after: 62 findings,
181 files, verdict still high-severity). Code: projects/mcp_vet/mcp_vet/service.py
(select_files, PRUNE_DIRS, NO_GRADEABLE_FILES), projects/mcp_vet/bench/grade_sample.py
(now imports the same select_files), projects/arcaeon_mcp/arcaeon_ledger_mcp/server.py
(ledger_append, _args_digest). Trace: projects/online_business/items_146_147_2026-09-05.md.Sorted by name for lookup, not by grade order. GRADED:no-gradeable-files = cloned, zero
.py/.ts/.js files after pruning. GRADED:<verdict> = cloned and at least one file scanned.
UNFETCHABLE = clone failed, reason recorded in the raw rows file (all 21 in this sample carry
the identical "could not read Username" signature, i.e. private or deleted).
ai.framethrower/framethrower | GRADED:no-gradeable-files
ai.presentations/presentations-ai | GRADED:high-severity findings
ai.smithery/arjunkmrm-brave-search-mcp-server | UNFETCHABLE
ai.smithery/skr-cloudify-clickup-mcp-server-new | UNFETCHABLE
ai.waystation/office | GRADED:high-severity findings
app.scfcontrolsplatform/mcp-server-scf | GRADED:no findings in checked classes
app.wishpool/japan-payments-mcp | UNFETCHABLE
au.com.casaintelligence/casa-property | UNFETCHABLE
bot.ttrpg/grimoire | GRADED:no-gradeable-files
cc.operandi/operandi | GRADED:high-severity findings
com.apiverve/mcp-server | GRADED:high-severity findings
com.axiomatic-ai/prover | GRADED:no-gradeable-files
com.blazesportsintel/college-baseball | UNFETCHABLE
com.boothcheck/boothcheck | GRADED:no-gradeable-files
com.catalystedgescanner/catalyst-edge-mcp | GRADED:high-severity findings
com.clauxel.aistudioworkspaceapproval/aistudioworkspaceapproval-mcp | GRADED:no-gradeable-files
com.clauxel.tracepiishield/tracepiishield-mcp | GRADED:no-gradeable-files
com.digitalpublic/marketing-operations | UNFETCHABLE
com.fabtally/slicer | GRADED:high-severity findings
com.figma.mcp/mcp | GRADED:no findings in checked classes
com.fluxdots/mcp | GRADED:no findings in checked classes
com.gradusmusic/notation | GRADED:high-severity findings
com.gribstream/mcp | GRADED:no-gradeable-files
com.hydrata/hydrata-mcp-server | GRADED:high-severity findings
com.luthersystems.insideout/mcp | GRADED:no findings in checked classes
com.microsoft/workiq-teamsserver | UNFETCHABLE
com.ontoramp/graph-query | GRADED:no-gradeable-files
com.ontoramp/knowledge-cartographer | GRADED:no-gradeable-files
com.webotee/amazon-product-research-mcp | GRADED:high-severity findings
dev.fentz.envcp/envcp | UNFETCHABLE
fr.renoolab/mcp | GRADED:no findings in checked classes
global.rootz.food/grocery | GRADED:no-gradeable-files
in.creo-memories/mcp-server | UNFETCHABLE
io.911fund.skills/directory | GRADED:no findings in checked classes
io.alterlab/mcp-server | GRADED:high-severity findings
io.carbone/carbone-mcp | GRADED:no findings in checked classes
io.dealscanner/dealscanner | UNFETCHABLE
io.getunleash/unleash-mcp | GRADED:no findings in checked classes
io.github.0xzr/freellmpool | GRADED:high-severity findings
io.github.4dmrkey/cryptopolitan | GRADED:high-severity findings
io.github.AIops-tools/observability-aiops | GRADED:high-severity findings
io.github.AhmedLaminou/windows-mcp-server | GRADED:no findings in checked classes
io.github.AiDimag/aidimag | GRADED:high-severity findings
io.github.Akhilgovind02/india-stock-mcp | GRADED:high-severity findings
io.github.Ansvar-Systems/uk-environmental-compliance | UNFETCHABLE
io.github.AryanBV/pdf-toolkit-mcp | GRADED:no findings in checked classes
io.github.AshwanthramKL/whoop-mcp | GRADED:medium-severity findings
io.github.AutomateLab-tech/ai-seo | GRADED:medium-severity findings
io.github.BorisGujvin/dittu | GRADED:no-gradeable-files
io.github.CSOAI-ORG/csrd-compliance-mcp | GRADED:high-severity findings
io.github.CSOAI-ORG/dataprivacy-ai-mcp | GRADED:high-severity findings
io.github.CSOAI-ORG/geolocation-ai-mcp | GRADED:high-severity findings
io.github.CSOAI-ORG/otp-ai-mcp | GRADED:high-severity findings
io.github.Clawdio777/verity | GRADED:no findings in checked classes
io.github.EthanQC/feishu-user-plugin | GRADED:high-severity findings
io.github.GLips/Figma-Context-MCP | GRADED:no findings in checked classes
io.github.GimbalGoats/maya-mcp | GRADED:high-severity findings
io.github.Gorp405/vett-compliance | GRADED:no-gradeable-files
io.github.Inefavel/sfmc-mcp-server | GRADED:medium-severity findings
io.github.InnarM/blank-invoice-maker | GRADED:high-severity findings
io.github.KincaidYang/whois | GRADED:no-gradeable-files
io.github.LovRanRan/mcp-repo-mapper | GRADED:high-severity findings
io.github.Mogacode-ma/elementor-mcp-agent | GRADED:medium-severity findings
io.github.MukundaKatta/shellquote-mcp | GRADED:high-severity findings
io.github.NeoZi12/dispatchseo | GRADED:no findings in checked classes
io.github.OpenHeritageOnline/public-search | GRADED:no findings in checked classes
io.github.PiQrypt/audit-trail | GRADED:high-severity findings
io.github.RudrenduPaul/taskswarm | GRADED:high-severity findings
io.github.TelcharFromNogrod/keen | UNFETCHABLE
io.github.TheSethRose/socialspool | UNFETCHABLE
io.github.Tom-R-Main/mcp-server | GRADED:no findings in checked classes
io.github.ToremLabs/heuresis | GRADED:high-severity findings
io.github.UnbearableDev/k8s-manifest-audit | GRADED:medium-severity findings
io.github.VibeTechnologies/vibe-mcp | GRADED:high-severity findings
io.github.Waysway-app/waysway | UNFETCHABLE
io.github.adacapo21/openmm-mcp | GRADED:no findings in checked classes
io.github.agentkitai/agentlens | GRADED:medium-severity findings
io.github.ai-aviate/better-notion | GRADED:no findings in checked classes
io.github.aleksUIX/rtblint | GRADED:no findings in checked classes
io.github.anaconda/anaconda-mcp | GRADED:high-severity findings
io.github.andrewschristison/pondlog-inaturalist | GRADED:no findings in checked classes
io.github.aniripsaretro-max/golemreach-heartbeat | GRADED:high-severity findings
io.github.api-freaks/apifreaks-mcp | GRADED:no findings in checked classes
io.github.artvepa80/hefestoai | GRADED:high-severity findings
io.github.attestagents/attest-mcp | GRADED:high-severity findings
io.github.azeemkafridi/bulkpublish | GRADED:high-severity findings
io.github.cct15/war-dashboard-data | GRADED:high-severity findings
io.github.claytono/go-unifi-mcp | GRADED:no-gradeable-files
io.github.cristianosantana/mcp-smart-hub | UNFETCHABLE
io.github.crunchtools/gitlab | GRADED:no findings in checked classes
io.github.crunchtools/trentina | GRADED:high-severity findings
io.github.cryptoeights/hyre-mcp | GRADED:high-severity findings
io.github.cyanheads/transitland-mcp-server | GRADED:no findings in checked classes
io.github.datacharter/datacharter | GRADED:high-severity findings
io.github.dbsectrainer/mcp-legal-doc-analyzer | GRADED:medium-severity findings
io.github.deployment-io/deployment-io | GRADED:no-gradeable-files
io.github.devilsfave/dagpipe | GRADED:high-severity findings
io.github.domdomegg/google-maps-places-mcp | GRADED:no findings in checked classes
io.github.dragnoir/shopify-theme-inspector | GRADED:medium-severity findings
io.github.emircbngl/blender-optics-simulator | GRADED:high-severity findings
io.github.encodi/simulate-monte-carlo | GRADED:no findings in checked classes
io.github.eodozzy/icloud-mcp | GRADED:high-severity findings
io.github.gaurav-kumar-sinha-060705/compass-mcp-gateway | UNFETCHABLE
io.github.ggozad/haiku-rag | GRADED:high-severity findings
io.github.giskard09/memory | GRADED:medium-severity findings
io.github.gitlumen-team/gitlumen-mcp | GRADED:no findings in checked classes
io.github.goldbergyoni/test-coverage-mcp | GRADED:medium-severity findings
io.github.hebcal/hebcal | GRADED:no findings in checked classes
io.github.inflectiv/inflectiv-mcp-server | GRADED:no-gradeable-files
io.github.iowarp/geo-mcp | GRADED:high-severity findings
io.github.jgravelle/jmunch-mcp | GRADED:high-severity findings
io.github.koki-develop/esa-mcp-server | GRADED:no findings in checked classes
io.github.lazymac2x/a11y-scorer | GRADED:no-gradeable-files
io.github.matematicsolutions/ca-eli-mcp | GRADED:high-severity findings
io.github.mcp-dir/antt_tric-mcp | GRADED:no-gradeable-files
io.github.mcp-dir/busca_google-mcp | GRADED:no-gradeable-files
io.github.mcp-dir/contas_comgas_download_seg_via-mcp | GRADED:no-gradeable-files
io.github.mcp-dir/detran_rn_veiculo-mcp | GRADED:no-gradeable-files
io.github.mcp-dir/detran_sc_veiculo-mcp | GRADED:no-gradeable-files
io.github.mcp-dir/ieptb_protestos_detalhes_sp-mcp | GRADED:no-gradeable-files
io.github.mcp-dir/pagseguro-mcp | GRADED:no-gradeable-files
io.github.mcp-dir/portal_transparencia_bolsa-mcp | GRADED:no-gradeable-files
io.github.mcp-dir/pref_go_firminopolis_cnd-mcp | GRADED:no-gradeable-files
io.github.mcp-dir/pref_go_goiania_cnd-mcp | GRADED:no-gradeable-files
io.github.mcp-dir/pref_go_morrinhos_cnd-mcp | GRADED:no-gradeable-files
io.github.mcp-dir/pref_mg_itauna_cnd-mcp | GRADED:no-gradeable-files
io.github.mcp-dir/registro_pf_br-mcp | GRADED:no-gradeable-files
io.github.mcp-dir/sefaz_go_ipva-mcp | GRADED:no-gradeable-files
io.github.mcp-dir/sefaz_pe_dec_caixa_postal-mcp | GRADED:no-gradeable-files
io.github.mcp-dir/sefaz_ro_ipva-mcp | GRADED:no-gradeable-files
io.github.mcp-dir/sefaz_sc_divida_ativa-mcp | GRADED:no-gradeable-files
io.github.mirabello-consultancy/mcp-server | GRADED:no-gradeable-files
io.github.mittalpk/pgvector | GRADED:high-severity findings
io.github.mpalermiti/outlook-mcp | GRADED:high-severity findings
io.github.myaitoken/myai-mcp | GRADED:high-severity findings
io.github.mybolide/mcp-probe-kit | GRADED:no findings in checked classes
io.github.nevse/dotnet-debugger-mcp | GRADED:no-gradeable-files
io.github.nirajagarwal/stox-mcp | GRADED:no-gradeable-files
io.github.nithishr/mcp-multi-poc-beta-script | GRADED:high-severity findings
io.github.partymola/google-health-mcp | GRADED:medium-severity findings
io.github.petitsolu/solubles | GRADED:no findings in checked classes
io.github.pipeworx-io/arcgis-pittsburgh | GRADED:no findings in checked classes
io.github.pipeworx-io/data-kcmo | GRADED:no findings in checked classes
io.github.pipeworx-io/ieee-standards | GRADED:no findings in checked classes
io.github.pipeworx-io/jsdelivr | GRADED:no findings in checked classes
io.github.pipeworx-io/nasa | GRADED:no findings in checked classes
io.github.pipeworx-io/openaq | GRADED:no findings in checked classes
io.github.pipeworx-io/performance-review | GRADED:no findings in checked classes
io.github.pipeworx-io/slack_connect | GRADED:no findings in checked classes
io.github.pipeworx-io/spoonacular | GRADED:no findings in checked classes
io.github.pipeworx-io/squiggle | GRADED:no findings in checked classes
io.github.prateekg7/context-bridge | GRADED:medium-severity findings
io.github.quizlar/mcp-server | GRADED:no findings in checked classes
io.github.rabdulsal/appstore-release-mcp | GRADED:high-severity findings
io.github.reidgoodbar/squire | GRADED:no findings in checked classes
io.github.robin24/simconnect-mcp | GRADED:no findings in checked classes
io.github.rohith1125/sentinel-execution-mcp | GRADED:no findings in checked classes
io.github.rosh-studio/rosh-mcp | GRADED:high-severity findings
io.github.rstreamlabs/rstream | GRADED:no findings in checked classes
io.github.rudimentall1/agent-guardrail | GRADED:high-severity findings
io.github.runesleo/polymarket-toolkit | GRADED:high-severity findings
io.github.ruriazz/xlsx-tools-mcp | GRADED:high-severity findings
io.github.salvo10f/godotiq | GRADED:no-gradeable-files
io.github.satoshkin-dev/satoshkin-aml-mcp | GRADED:no findings in checked classes
io.github.selflabbs/market-intel-mcp | GRADED:no findings in checked classes
io.github.sercanmetalore/rag-service-mcp | UNFETCHABLE
io.github.sharebook-kr/pykrx-mcp | GRADED:high-severity findings
io.github.shopanaio/novaposhta | GRADED:medium-severity findings
io.github.stevologic/security-recipes | GRADED:high-severity findings
io.github.stucchi/telnyx | GRADED:high-severity findings
io.github.swnotmetal/koma-gate-mcp | GRADED:high-severity findings
io.github.syamaner/coffee-roaster-mcp | GRADED:high-severity findings
io.github.talktosims/sage-infinite-search | UNFETCHABLE
io.github.thomasjudes-del/ficturn | GRADED:no findings in checked classes
io.github.timohaa/scopewalker-mcp | GRADED:no findings in checked classes
io.github.tombaldwin/ebman | GRADED:no-gradeable-files
io.github.toolhail/gateway | GRADED:high-severity findings
io.github.topofgames/la-ei-romania | GRADED:no-gradeable-files
io.github.vassiliylakhonin/agenda-intelligence-md | GRADED:high-severity findings
io.github.verbart/tradernet-mcp | GRADED:high-severity findings
io.github.veynor-xyz/veynor | GRADED:low-severity findings
io.github.vndee/llm-sandbox | GRADED:high-severity findings
io.github.vola-trebla/sourcemap-retrace-mcp | GRADED:high-severity findings
io.github.webaesbyamin/agent-receipts | GRADED:no findings in checked classes
io.github.weiyongxu/mne-docs | UNFETCHABLE
io.github.winter0x/lighter-mcp | UNFETCHABLE
io.github.wishfinity/wishfinity-mcp-plusw | GRADED:high-severity findings
io.github.xberg-io/crawlberg | GRADED:medium-severity findings
io.github.xiaojiou176-open/openvibecoding-readonly | GRADED:high-severity findings
io.github.xpaysh/marketing | GRADED:no-gradeable-files
io.github.yk647/globalrules | UNFETCHABLE
io.github.yuna0x0/hackmd-mcp | GRADED:no findings in checked classes
io.github.zyx77550/sparda-mcp | GRADED:no findings in checked classes
io.kolvera/kolvera | GRADED:no-gradeable-files
io.seaworthy/mcp | GRADED:no findings in checked classes
io.siteglass/mcp | GRADED:high-severity findings
io.usefulapi/twenty | GRADED:no-gradeable-files
net.gepuro.mcp-company-lens-v1/company-lens-mcp-registry | GRADED:no-gradeable-files
sh.antrieb/antrieb | GRADED:no-gradeable-files
xyz.yault/aesp | GRADED:high-severity findings