Prototype · Preview: every server in the official registry, synced every 30 minutes. Sign in with Google to write reviews.Prototype · updated every 30 min
PopNx MCPMCP servers for people who use AI · explained in plain words
☰ MenuEnglish Settings
Beginner mode On
ColoursSystemLightWhiteDark
LanguageไทยEnglish中文日本語한국어EspañolDeutsch

What we check

Everything below is what our system really does for every server, using public data only. It is not a security certification, and we give no overall grade.

  1. Maker matches the repo

    We compare the name registered in the Official MCP Registry with the GitHub repo owner or a domain the registry verified. A mismatch can mean someone else re-listed it.

  2. Still maintained

    We read the last code change on GitHub. Over 6 months = caution · over 1 year or archived = fail.

  3. Has a license

    We read the license type GitHub detects in the repo. No file = fail · a maker’s own cloud server skips this check.

  4. Cloud address answers

    We send an MCP start request and ask for the tool list, waiting up to 6 seconds, with no keys or anyone’s data. The 2,000 most used are checked daily, the rest in rotation.

  5. OAuth sign-in

    We check whether the server announces a sign-in flow the AI app can handle, or needs a key pasted by hand.

  6. No hidden instructions in tool descriptions

    We read every tool description a cloud server announces, looking for text that tries to steer the AI into things you did not ask for.

  7. Copyable commands pass our checker

    Every command and config the site lets you copy must pass first: allowed programs only (npx, uvx, docker and a few more), no shell chaining characters, the package version really exists on npm, PyPI or Docker, and addresses use https. Not passed = no copy button.

  8. Published vulnerabilities (OSV.dev)

    We ask the open OSV.dev database whether the npm or PyPI version we recommend has vulnerability entries, re-checking every 7 days. Only that package version, not every dependency. If the query fails we say “not checked yet”.

  9. Response history

    We keep one cloud-address result per server per day for 30 days and show “answered N of the last M checks” over the last 7, once there are at least 3. It is not round-the-clock uptime.

Results as JSON

Each server’s results are at /api/servers/<slug>/checks.json, no key needed.

Makers: ask for a re-check or report wrong info

Use the button in the checks section of your server page. You need to sign in; up to 3 requests per account per day. Our team reads every one.

Browse servers →