MCP Trust Index
19,000+ MCP servers exist across 17+ directories. Independent research shows 66% have security findings. Enterprises need a vetted shortlist — not another directory. We don't list first. We list last.
The Problem with MCP Server Discovery
The Model Context Protocol ecosystem is growing at 873% year-over-year. There are 17+ registries and directories, each racing to index the most servers. But volume is not trust.
AgentSeal scanned 1,808 MCP servers and found 43% have shell injection vulnerabilities. A fake Postmark MCP server on npm exfiltrated API keys. 30 CVEs were disclosed in a single 60-day window. The OWASP Foundation published an MCP Top 10 security list.
The MCP Trust Index takes a different approach. We aggregate publicly verifiable trust signals — downloads, security audits, maintenance history, community health — into a transparent scoring model with a high bar. The crowd does the vetting. We do the curation.
Connect the Index to Your Agent
The Trust Index is itself an MCP server — the index about MCP servers, served as one. Point any MCP client at the endpoint and your agent can answer "which MCP server should I trust for X?" from this list, with scores, caveats, and install commands. Read-only, no auth, no install. Works the same for a solo builder's laptop and an enterprise rollout.
https://staas.fund/mcp/serverclaude mcp add --transport http mcp-trust-index https://staas.fund/mcp/serverTools: search_servers · get_server · get_rubric · get_watchlist · get_changelog. By our own maturity gate, this server won't qualify for its own index until it has six months of track record — we hold ourselves to the same bar.
Trust Tiers
Servers that pass our gate are scored and placed into tiers. Each listing includes a human-written assessment.
Enterprise Verified
Deploy with confidence. Battle-tested, well-maintained, broadly compatible. Suitable for production workloads at scale.
Recommended
Strong track record with minor gaps. Suitable for most enterprise use cases. Review the noted caveats before deploying.
Emerging
Passed all gates but still building track record. Monitor closely. Suitable for non-critical workloads or evaluation.
The Gate: Minimum Thresholds
A server must pass every gate below to be considered for the Index. Failing any single requirement is disqualifying — no exceptions, no overrides, no pay-to-bypass.
1 Maturity
New servers haven't survived enough real-world usage to trust. We wait for the signal.
2 Security
One unpatched critical vulnerability is disqualifying. We check OSV, NVD, Snyk, Socket.dev, and AgentSeal.
3 Maintenance
Unmaintained servers are ticking time bombs. Active maintenance is non-negotiable.
4 Identity & Transparency
Enterprises cannot deploy black boxes. Inspectable code, verified ownership, identifiable maintainer.
5 Interoperability
Enterprise environments use multiple AI clients. A server locked to a single client is a vendor trap.
Scoring Dimensions
Servers that pass the gate are scored across four dimensions (100 points total) and placed into trust tiers.
Adoption
- Weekly downloads vs. category median
- Growth trajectory
- Dependent packages / integrations
- Presence in official client docs
Security Track Record
- Historical CVE count & time-to-patch
- Third-party audit history
- Dependency health
- Auth model quality
Community Health
- Contributor count & bus factor
- Issue response time
- Release cadence & changelog
- Documentation quality
Enterprise Readiness
- Configuration complexity
- Error handling & logging
- Client compatibility breadth
- Official support channel
What We Don't Do
We don't list first
If a server launched last month, it's not on our list. We recommend at 6+ months. Being late is the product.
We don't list everything
19,000 servers exist. We recommend fewer than 200. Curation is exclusion.
We don't accept pay-for-placement
If a server is on our list, it earned it. If it's not, no amount of money changes that.
We don't compete with registries
The official MCP Registry, PulseMCP, and others index. We recommend. Different jobs.
Categories
The Index organizes servers by enterprise use case.
The Index
MCP servers that have passed our gate and earned a trust tier. Scored monthly. Sorted by score.
GitHub
Full GitHub API — repositories, issues, PRs, code search, Actions, secret scanning. 28K+ stars. Official hosted endpoint also available (api.githubcopilot.com/mcp, OAuth). For untrusted public repos, run with --read-only and Lockdown mode — prompt-injection via issue text is a demonstrated attack class.
docker run -i ghcr.io/github/github-mcp-server
Playwright
Browser automation via accessibility tree. Navigate, click, screenshot, scrape JS-rendered pages. 29K+ stars, most-used MCP server.
npx @playwright/mcp
Filesystem
Secure file operations with configurable access controls. Read, write, move, search within allowed directories. 137K weekly downloads.
npx -y @modelcontextprotocol/server-filesystem
Context7
Version-accurate, up-to-date library documentation and code examples injected straight into your coding agent's context. 60K+ stars, 779K weekly downloads — the de facto standard for docs-aware coding. Free remote endpoint at mcp.context7.com.
npx -y @upstash/context7-mcp
Chrome DevTools
Drive and inspect a live Chrome — debugging, performance traces, network inspection, console access. The browser-debugging half Playwright doesn't cover. 49K stars, 2.2M weekly downloads. Historical CVE-2026-53766 (symlink path validation) patched in v1.1.0; current release 1.7.0.
npx -y chrome-devtools-mcp@latest
Notion
Full Notion API — create, read, update, search pages, databases, and comments via 22 tools. 48K weekly downloads. Notion now prioritizes its hosted remote server (mcp.notion.com); the local repo is in maintenance mode with stated sunset risk — prefer the remote endpoint for new setups.
npx -y @notionhq/notion-mcp-server
Supabase
Full Supabase access — databases, auth, storage, edge functions, management API, migrations. 46K weekly downloads. Config rule: never bind a service_role key to an agent that ingests untrusted content (the "lethal trifecta") — use read-only mode and project scoping.
npx -y @supabase/mcp-server-supabase
Atlassian (Jira + Confluence)
72 tools for Jira and Confluence — issues, pages, search, sprints. Cloud + Server/DC. 793K monthly downloads. Re-scored Aug 2026: critical unauthenticated RCE (CVE-2026-27825) was patched promptly in 0.17.0 — pin 0.17.0 or later, and never expose the HTTP transport without auth. Atlassian's official remote server is a lower-risk option for Cloud users.
uvx mcp-atlassian
Serena
Language-server-powered semantic code retrieval and editing — find symbols, references, and make precise edits instead of grepping whole files. Makes any coding agent sharper and cheaper. 28K stars, 156K monthly downloads.
uvx --from serena-agent serena start-mcp-server
Postgres MCP Pro
Read/write PostgreSQL with AI-assisted index tuning and performance analysis. Replaces deprecated Anthropic Postgres ref server.
uvx postgres-mcp
Exa Search
AI-optimized semantic web search and crawl. Real-time results, structured data, LinkedIn/Twitter integration. 4.1K stars.
npx -y exa-mcp-server
MarkItDown
Convert PDF, Office, HTML, images, and audio to clean Markdown for LLM consumption — the standard RAG-ingestion utility. Parent library has 174K stars; MCP wrapper pulls 285K monthly downloads.
uvx markitdown-mcp
Firecrawl
Full-stack web scraping — JS-rendered pages, batch scraping, structured extraction, site mapping. 7.3K stars, 91K weekly downloads. Note: releases ship to npm ahead of GitHub tags — track the npm version (3.24+), not the repo's release page.
npx firecrawl-mcp
Azure
Azure resources via natural language — storage, Cosmos DB, App Service, CLI, monitoring, and dozens more services from Microsoft's official MCP monorepo. 104K weekly downloads. Still versioned as beta; APIs may shift between releases.
npx -y @azure/mcp@latest server start
Cloudflare
16 MCP servers — Workers, KV, D1, R2, DNS, AI Gateway, Browser Rendering. 4K stars. Cloudflare is consolidating into a unified remote endpoint (mcp.cloudflare.com) covering the full API; Radar is already folded in.
npx @cloudflare/mcp-server-cloudflare
Brave Search
Web, image, video, news, and local search via Brave Search API. Privacy-first, advanced operators.
npx @brave/brave-search-mcp-server
ClickHouse
SQL query execution, table management, and database inspection on ClickHouse analytics databases. 155K monthly downloads.
uvx mcp-clickhouse
Qdrant
Semantic memory via Qdrant vector search with embedding support. Store and retrieve information. 1.3K stars, 90K monthly downloads.
uvx mcp-server-qdrant
Memory
Knowledge graph-based persistent memory for AI assistants. Create entities, relations, and observations. 72K weekly downloads.
npx -y @modelcontextprotocol/server-memory
Fetch
Fetch web pages and convert to markdown for LLM consumption. Respects robots.txt. Install exactly mcp-server-fetch — a similarly named third-party package ("fetch-mcp" / "mcp-fetch-server") carries an unpatched critical SSRF and is not this server.
uvx mcp-server-fetch
Sentry
Errors, issues, releases, performance data, source maps. 30K weekly downloads. Re-scored Aug 2026: "Agentjacking" research showed public DSNs let attackers inject instructions into error events that agents then execute; Sentry's mitigation is a content filter, not a structural fix. Treat error payloads as untrusted input.
npx -y @sentry/mcp-server
Google Workspace
Gmail, Calendar, Drive, Docs, Sheets, and more — 12 Workspace services behind OAuth 2.1. No official Google Workspace server exists; this is the clear community leader. 3K stars, 329K monthly downloads.
uvx workspace-mcp
Google Cloud
gcloud CLI operations via MCP — inspect, manage, and troubleshoot GCP resources. 12K weekly downloads. Google labels it a preview, "not an officially supported Google product" — hence Emerging.
npx -y @google-cloud/gcloud-mcp
Perplexity
Reasoning-augmented web search via Perplexity's Sonar API — answers with citations instead of raw links. 2.4K stars. Recently formalized as official; adoption track record still building.
npx -y server-perplexity-ask
Neon
Serverless Postgres — create/manage databases, branches, run SQL via Neon Management API. 20+ tools. Neon now steers users to its hosted endpoint (mcp.neon.tech, OAuth); the npm package is deprecated and the repo remains as a self-host fallback.
npx @neondatabase/mcp-server-neon
Kubernetes
Native Go MCP server communicating directly with the Kubernetes API. Manage clusters, pods, deployments, services. 1.3K stars.
npx kubernetes-mcp-serverHosted & Platform-Native Servers
The ecosystem is splitting in two. Alongside open, independently verifiable servers, vendors now ship closed-source hosted endpoints or fold MCP into the product itself. Many are genuinely mature — but our gate requires inspectable code, so we can't score them. We list them here instead of pretending they don't exist. Trust here means trusting the vendor, not the code.
Hosted, closed-source
Slack (GA, OAuth) · HubSpot (mcp.hubspot.com, GA) · Linear (mcp.linear.app) · Figma (Dev Mode, app-bundled) · Canva (mcp.canva.com) · Asana (mcp.asana.com) · Zapier (8,000+ app fan-out). Mature operations, no inspectable source — evaluate under your vendor-risk process, not ours.
Platform-native
Snowflake (Cortex Agents MCP — standalone repo deprecated) · Elastic (Agent Builder, built into Elasticsearch 9.2+) · Weaviate (built into core from v1.37.1) · JetBrains (built into IntelliJ-platform IDEs 2025.2+). The MCP server became a product feature — nothing separate to download, gate, or score.
Changelog
August 19, 2026 — Full re-evaluation (29 → 38 servers)
Added (11): Context7 (91), Chrome DevTools (89), Serena (79), MarkItDown (76), Azure (73), Tavily (72), Google Workspace (61), Google Cloud (56), Perplexity (54), Airtable (48), Obsidian (47).
Removed (2): Puppeteer — archived and deprecated by Anthropic, migrate to Playwright. JetBrains — standalone proxy stale 200+ days (maintenance gate) and superseded by MCP built into the IDEs.
Re-scored (2): Atlassian 89→82 — critical unauthenticated RCE (CVE-2026-27825), patched promptly in 0.17.0; prompt patching kept it listed, severity moved the score. Sentry 72→62 — "Agentjacking" zero-auth prompt injection via public DSNs; mitigation is a content filter, not a structural fix.
Verified clean: every remaining server re-checked against downloads, stars, staleness, and OSV/GitHub advisories. Terraform (CVE-2026-16498/16496), Playwright (CVE-2025-9611), Grafana (CVE-2026-33810), and Filesystem (CVE-2025-53109/53110) all had CVEs since our last update — all patched, which is exactly the response our gate requires.
New: the Hosted & Platform-Native section above, replacing the old watch list — five of its seven entries resolved into closed hosted endpoints or product features rather than gate-passing servers. Still watching: PagerDuty (closest to graduating), Twilio, PlanetScale, Netlify, Vercel, DeepWiki.
March 27, 2026 — Index launched with 29 servers (Weaviate was cut in final review: standalone repo already stale, since superseded by MCP built into Weaviate core).
About the MCP Trust Index
The MCP Trust Index is a curated, enterprise-grade list of Model Context Protocol (MCP) servers published by StaaS Fund, a venture capital fund investing in agentic AI infrastructure led by Peter Saddington. The Index evaluates MCP servers across maturity, security, maintenance, identity, and interoperability using publicly verifiable trust signals including npm/PyPI download counts, GitHub activity, OSV and NVD vulnerability databases, AgentSeal security scans, and OWASP MCP Top 10 compliance. Servers are scored on a 100-point scale across four dimensions — adoption, security track record, community health, and enterprise readiness — and assigned to Enterprise Verified, Recommended, or Emerging tiers. The methodology is transparent and no listings are paid. Updated monthly at staas.fund/mcp.
Know an MCP Server That Should Be Here?
We evaluate new servers monthly. If you've built or used an MCP server that meets our gate criteria, let us know.
Submit a Server