Is this MCP server safe to connect to?
One standard MCP handshake (initialize, tools/list, resources/list, prompts/list), scored against 27 deterministic rules. We never call a tool or send adversarial input — this reads what any MCP client reads on first connect, nothing more. Browse every server we’ve scanned below, free — running a new scan or discovering a domain’s MCP servers is part of PlayCISO Pro.
Explorer
Frequently asked questions
Is browsing the explorer free?
Yes — no signup, no API key. Every server on this page has already been scanned; browsing, filtering and viewing detail pages is free.
Is running a new scan free?
Running your own server through a scan, or discovering a domain’s MCP servers, is part of PlayCISO Pro (from $9/week). MCP Guard, Prompt Scan and Reputation Checker remain free scanners with no account.
Does this exploit or attack the server?
No. It performs exactly one standard MCP handshake — initialize, tools/list, resources/list, prompts/list — the same discovery calls any MCP client makes on first connect. It never calls a tool, never sends adversarial arguments, and never retries with different input. It reads what the server advertises, not what it does when told to act.
How is the score calculated?
A fixed, versioned rule table checks the handshake response against 27 deterministic rules — missing authentication, high-impact tool names exposed without auth, prompt-injection patterns in tool descriptions, plain HTTP instead of HTTPS, wildcard CORS, missing version info, unconstrained input schemas, and more. Every rule is pattern-matching, not an AI judgment call, so the same handshake always re-scores identically.
Why don’t I see the exact vulnerable tool or parameter?
By design. The public explorer shows category and severity, not reproduction detail, so the leaderboard can’t double as a target list for opportunistic attackers. A verified, paid owner can unlock the raw request/response evidence for their own server.
Where do the registry-seeded servers come from?
From the official MCP registry (registry.modelcontextprotocol.io), where server operators publish their own listings specifically to be discovered and connected to by MCP clients. A standard handshake against a self-published, publicly-listed endpoint is what the registry exists for.
Can I get my server removed or re-scored?
Yes — verify ownership from the server’s detail page to control your listing, or contact PlayCISO to request removal.