frequently asked

How scoring and findings work

How is the score computed?

Every server starts at 100. Each finding scales down the remaining score by an amount set by its severity (critical, high, medium, low) and confidence (high, medium, low) — a multiplicative decay, not a flat subtraction, so one critical finding can't zero out a server on its own, but a pile of smaller findings still compounds. A server with no findings scores 100; adding findings only ever moves the score down.

Does mcphound ever run the servers it scores?

No. Every score on this site comes from static analysis of a server's published config and source — mcphound never installs, executes, or connects to a server to produce a finding.

What counts as a finding?

Static analysis rules covering things like hardcoded secrets, download-and-execute launch commands, over-broad permissions, pinned-version drift, and typosquatted package names. Every rule maps to a code in the OWASP Top 10 for LLM or Agentic applications — see the full rule catalog on GitHub for exact detection logic and severity.

I think a finding is wrong — how do I dispute it?

Run "mcphound feedback <rule-id> --note \"why you think this is wrong\"" — it prints a pre-filled GitHub issue URL with the rule and version, no network call or auth required. False-positive fixes are treated as release-blockers.

What's a typosquat cluster?

A known, established MCP package paired with any published registry entries whose name is one or two characters away from it — the kind of edit a person skims past and a copy-paste doesn't catch. Each cluster page shows the exact characters that differ.

How often is the registry rescanned?

The public MCP registry is polled and every tracked server rescanned once a day. Score and finding pages reflect the most recent nightly run, timestamped on each server's page.

Where's the source?

mcphound is open source. The scanner is also published on PyPI and runs locally against your own MCP configs — see the GitHub repository linked in the footer for the CLI, rule definitions, and this site's code.