Severity Levels
MCPSafe keeps security, quality, usage, freshness, MCP capability risk, and supply-chain metadata as separate numeric signals. Public security grades are based only on reviewed findings; Trust Score is the stricter headline score users should rely on for adoption decisions.
Security Grades
Registry trust uses multiple inputs. A perfect reviewed-security score does not automatically mean a perfect Trust Score; unknowns, risky MCP capabilities, stale metadata, weak supply-chain signals, and poor maintenance can all reduce confidence.
Trust Score Inputs
Reviewed security
Promoted, evidence-backed findings only. Unreviewed scanner output remains private.
Quality
Maintenance, documentation, compatibility, release hygiene, and project metadata.
MCP capability risk
Penalties for shell execution, filesystem access, secret handling, remote transports, database access, and MCP-specific rule hits.
Supply chain
Repository presence, license clarity, package/version metadata, issue load, and maintainer hygiene.
Freshness
Recent successful source-aware scan and registry synchronization.
Usage/popularity
Stars, downloads, forks, and upstream adoption signals.
Critical
Critical vulnerabilities represent the highest risk. They can be exploited immediately with minimal effort and typically lead to full system compromise, remote code execution, or complete data breach.
Potential Impact
- Remote code execution
- Full system compromise
- Complete data breach
- Credential theft at scale
Examples
- Command injection via child_process.exec() with user input
- eval() or Function() with untrusted data
- Hardcoded database credentials or API keys
- Unrestricted file upload allowing code execution
Remediation Priority: Address immediately. Critical vulnerabilities should be fixed before any deployment.
High
High severity vulnerabilities pose significant security risks. While exploitation may require some conditions to be met, successful attacks can result in substantial damage.
Potential Impact
- Unauthorized data access
- Privilege escalation
- Significant data manipulation
- Partial system compromise
Examples
- SQL injection allowing data extraction
- Path traversal enabling file read/write
- SSRF vulnerabilities to internal services
- Insecure deserialization of untrusted data
Remediation Priority: Fix within days. High severity issues should be prioritized in the next development cycle.
Medium
Medium severity vulnerabilities require specific conditions for exploitation but can still lead to security compromises under the right circumstances.
Potential Impact
- Limited unauthorized access
- Information disclosure
- Denial of service potential
- Data integrity issues
Examples
- Weak cryptographic algorithms (MD5, SHA1 for passwords)
- Missing input validation on non-critical fields
- Verbose error messages exposing internal details
- Insufficient rate limiting
Remediation Priority: Plan to fix within weeks. Medium severity issues should be addressed in regular maintenance.
Low
Low severity vulnerabilities have limited impact and require significant effort or unlikely conditions to exploit. They represent minor security concerns.
Potential Impact
- Minor information leakage
- Potential for future issues
- Non-standard security practices
- Limited availability impact
Examples
- Debug code left in production
- Deprecated but not vulnerable functions
- Missing security headers (non-critical)
- Overly permissive CORS configuration
Remediation Priority: Address when convenient. Low severity issues can be batched with other maintenance work.
Info
Informational findings are recommendations and best practices that don't represent immediate security risks but could improve overall security posture.
Potential Impact
- Code quality improvement
- Security best practices
- Future-proofing suggestions
- Documentation recommendations
Examples
- Suggestions to use TypeScript strict mode
- Recommendations for security documentation
- Suggestions for additional input validation
- Performance-related security improvements
Remediation Priority: Consider implementing. Informational findings are optional improvements.