OWASP-MCP-Top-10 · trust registry

npm for MCP servers — except every package ships a security grade you can read.

Stars measure popularity. We measure supply-chain risk. Scan a server, read the grade, install it safely across Claude, Cursor, and Windsurf.

Scan before you install

$ mcpr scan <cmd|url>

Grades any server in seconds — even ones not in the index. Unknown ≠ unsafe.