Free Verify scan · modelcontextprotocol/servers

servers scores 68/100

Reference implementations of Model Context Protocol servers.

Commit bbb701e · 132 controls · Oct 15, 2026 · Re-checked daily

Scanned with public access only. Customer results are never published.

Delivery controls score68

servers

42median 6886

Out of 100. Stronger than 43% of the 68 other assessed repositories.

Score

68/100

Rank 33 of 69 · median 68

Gaps

3 more than the median of 33

Critical

0 controls

0 root causes

Not visible

Needs admin access

What servers does wellDefault branch identifiedBranch strategy observableDefault branch protected by rulesetForce-push restrictedPull-request requirement on default branch

Gaps36

servers

15median 3361

Visible controls Verify found unmet. Fewer is better. Stronger than 28% of the 68 other assessed repositories.

How does your team compare?

This is what Canon Verify found in servers's public configuration. Your team's process probably has the same gaps. Most private repos do.

See how your team scores

5 minutes. No repository access needed.

Scan your own repo with Verify (free)

Analysis

Our read

Agents & AI leads the assessment.

6 of 6 visible controls pass in agents & ai.

Security has the most room to improve.

7 visible controls remain open in security.

Priority

Fix these first

high

CODEOWNERS or review assignment

Covers 5 controls

CODEOWNERS or review assignment
CODEOWNERS or OWNERS file
Maintainer roster
Review of high-risk dependency changes
Migrations reviewed

What Verify read

No tree evidence for owners.

Risk: With no ownership file, review lands on whoever is available rather than whoever understands the code.

text

Add CODEOWNERS.

Have this gap too? Start from the PR Review Pipeline flow.

Open in Design

high

Last-push approval required

Covers 1 control

Last-push approval required

What Verify read

Last-push approval: false

Risk: A final push after approval can introduce anything, and the merge still shows a green review.

text

Require last-push approval.

high

Workflow permissions least-privilege

Covers 1 control

Workflow permissions least-privilege

What Verify read

One or more workflows do not declare a permissions block.

Risk: Broadly permissioned workflows hand a write token to every action they call, including third-party code.

text

Set least-privilege GITHUB_TOKEN.

Overview

Control map

Public-access limit

16 controls this scan couldn't read

This free scan used public access only. These controls live in settings only a repository admin can read. Verify checks them on your connected repository.

No unattended prod migrationcritical
Administrator bypass restrictedhigh
Tag protectionhigh
Self-merge restrictedhigh
Bypass actors justifiedhigh
Push protection enabledhigh
Dependabot alertshigh
Secret scanning alertshigh
SAST required on default branchhigh
Environment secrets scopedhigh
Secret custodiansmedium
Agent identity in commitsmedium
Audit of agent actionsmedium
Audit of privileged actionsmedium
Private vulnerability reportinglow
Wait timer or freeze windowlow

Get Verify

Method

How Verify works

Read

Verify reads the repository at a pinned commit: settings, rulesets, workflows, and files.

Judge

Each control is checked against a written expectation. Same inspector, same criteria, every repository.

Prove

Every result shows the evidence Verify read. Assessments re-run daily, and changes are logged.

132 controls · 69 repositories assessed · re-run daily

	This free scan	Verify on your repository
Access	Public	GitHub App you install
Controls read	113 of 113	All 113
Private repositories	No	Yes
Results	Published here	Private to your organization

Evidence locker

Every control Verify checked

Governance

8 of 12 pass

Review

13 of 26 pass

CI & tests

22 of 30 pass

Code quality

5 of 8 pass

Security

7 of 20 pass

Release & ops

11 of 22 pass

Docs

5 of 6 pass

Assessment timeline

Canon re-assesses this repository daily. An entry appears only when something changed — the score, a control's outcome, or a control ceasing to apply.

Sep 21 · 59Oct 15 · 68

Oct 12, 2026Actions from trusted sources · Security — gap → confirmedbbb701e
Oct 12, 2026Formatter agreed · Code quality — gap → confirmedbbb701e
Oct 12, 2026Required lint check · Code quality — gap → confirmedbbb701e
Oct 12, 2026Delivery controls score 60 → 68bbb701e
Oct 12, 2026Required checks match workflow names · CI & tests — gap → confirmedbbb701e
Oct 12, 2026Required status checks strict · CI & tests — gap → confirmedbbb701e
Oct 12, 2026Required check includes tests · CI & tests — gap → confirmedbbb701e
Oct 12, 2026Coverage gate · CI & tests — gap → confirmedbbb701e
Oct 12, 2026Lint command · Code quality — gap → confirmedbbb701e
Oct 12, 2026Lint runs in CI · Code quality — gap → confirmedbbb701e
Oct 5, 2026Issue templates present · Review — gap → confirmed5abed86
Oct 5, 2026Delivery controls score 59 → 605abed86

Get this report for your own repository.

Canon Verify runs the same inspection on your private repo. Read-only GitHub App. First scan free.

Scan your repo free See how your team scores

Read-only access. No code stored. How Canon handles your data →

View modelcontextprotocol/servers on GitHub

Maintain servers? If anything here is inaccurate or out of date, email security@strikelabs.co and we'll correct it.