# stillos-ratings-mcp [Health: Active]

**Category:** 🔒 Security  
**Repository:** https://github.com/stillmarcus24/stillos-ratings-mcp  
**GitHub Stars:** 0  
**Views:** 0  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/stillos-ratings-mcp

## Description
Check an MCP server before you install it — outside-in trust ratings for 7,000+ operators.

## Tools
Capabilities this server exposes over MCP:

- **check_mcp_server** — Grade, rank, five scored dimensions, rail position, publisher/fleet concentration, and any dated finding for one host
- **list_tool_surface_findings** — Every operator currently carrying a dated tool-surface finding
- **compare_mcp_servers** — Up to 10 candidates side by side

## Claude Desktop Quick Installation
No confirmed install details yet, so no config is published. Follow the setup steps in the repository above.

## Documentation

## What stillos-ratings-mcp MCP server does

stillos-ratings-mcp MCP server provides outside-in ratings for MCP operators before you install their software. It uses a public census of more than 7,000 operators and reports a grade, population rank, five scored dimensions, rail position, publisher and fleet concentration, and any dated finding recorded for a host.

The primary security signal concerns a tool surface that changed while the endpoint's version string stayed the same. The service compares anonymous `tools/list` observations from different times. If the tool list changes without a corresponding version change, a client that approved the earlier list may not have been asked to review the new tools.

A finding is an observation about change, not a claim of malicious intent. The ratings are percentile positions within the measured population, not an audit or security certification. An unrated host returns `NOT_RATED`; that indicates coverage limits, not that the host is safe.

## How it works

The package is a thin client over `GET https://stillosdigitalholdings.com/ratings/node?host=<host>`. It does not require an API key, signup, or account, and the endpoint is described as free and unmetered. The underlying census is refreshed every six hours.

Each `check_mcp_server` response includes a receipt hash and a recompute link. The published methodology and public records allow the reported figures to be independently recomputed. Receipt verification establishes the integrity and timestamp of the sealed board; it does not establish that a rating is correct.

Fleet information adds structural context: the response identifies the publisher, the number of servers attributed to that publisher, and how many other servers share its core tool set. If the registry does not cover a host, concentration is reported as not measured rather than as evidence that the host is not part of a fleet.

## Setup and configuration

Run the command-line package with `npx`:

```bash
npx stillos-ratings-mcp check api.mcp.ai
npx stillos-ratings-mcp findings
npx stillos-ratings-mcp compare api.mcp.ai some-other-host.com
```

To expose stillos-ratings-mcp MCP server tools to an MCP client, add a stdio entry using `npx`:

```json
{
  "mcpServers": {
    "stillos-ratings": {
      "command": "npx",
      "args": ["-y", "stillos-ratings-mcp", "mcp"]
    }
  }
}
```

No credentials or environment variables are required according to the provided material. The package holds no credential, so its requests can be reproduced with `curl` against the public endpoint.

## Tools and capabilities

- `check_mcp_server`: returns a host's grade, rank, five scored dimensions, rail position, publisher and fleet concentration, and any dated finding.
- `list_tool_surface_findings`: lists every operator currently carrying a dated tool-surface finding.
- `compare_mcp_servers`: compares as many as 10 MCP server candidates side by side.

These capabilities place the stillos-ratings-mcp MCP server in the Security category for pre-installation review. They are most useful when choosing among unfamiliar remote hosts or checking whether a candidate has a recorded tool-surface change.

## Limitations and notes

The service only covers part of the public registry: the README reports 41.8% of distinct remote-declaring hosts as enumerated on 2026-10-04. Missing coverage is not a safety result. Likewise, no finding means only that this specific failure mode was not observed on that host.

Fleet concentration describes how a server appears to have been produced; it is not a judgment about good or bad faith. Ratings are not self-reported, but they remain measurements of the available public census. The tool does not claim to audit source code, certify operators, or provide a general clean bill of health.

_Full upstream README: https://allmcps.com/mcp/stillos-ratings-mcp/readme_