A side-by-side look at the MCP Shield and Stillos Ratings MCP MCP servers: transport, auth, tools, quality signals, and the config to install either one in Claude, Cursor, Windsurf or VS Code.
Verdict: choose MCP Shield for security work as a local process; choose Stillos Ratings MCP for security. You can also run both side by side in one mcpServers block.
scan_package, scan_directory, check_prompt_injection.check_mcp_server, list_tool_surface_findings, compare_mcp_servers.Rows where the two servers differ are marked.
| Spec | S Stillos Ratings MCP | |
|---|---|---|
| Category | Security | Security |
| Quality signal | 57/100 · Good | 47/100 · Fair |
| Install command | Confirmed | Not confirmed yet |
| Transport | Local subprocess (stdio) | — |
| Auth | No auth required | No auth required |
| Pricing | Free | Free |
| Required env vars | None listed | None listed |
| Verified owner | Community listing | Community listing |
| GitHub stars | 2 | 0 |
| Directory activity | 3 views 0 installs 0 upvotes | 0 views 0 installs 0 upvotes |
| Tools | 4 | 3 |
| Full listing | View MCP Shield | View Stillos Ratings MCP |
scan_packageDownload an npm MCP package and scan it for malicious patternsscan_directoryScan a local MCP server directory (cloned from GitHub, etc.)check_prompt_injectionCheck tool descriptions or responses for hidden injectionsaudit_supply_chainGet trust score, CVEs, maintainer count, and age for any npm packagecheck_mcp_serverGrade, rank, five scored dimensions, rail position, publisher/fleet concentration, and any dated finding for one hostlist_tool_surface_findingsEvery operator currently carrying a dated tool-surface findingcompare_mcp_serversUp to 10 candidates side by sidePaste either block (or both) into your client config, e.g. claude_desktop_config.json or ~/.cursor/mcp.json. We only show a config when the install command is confirmed.
{
"mcpServers": {
"muhannad-hash-mcp-shield": {
"command": "npx",
"args": [
"-y",
"mcp-shield"
]
}
}
}
No confirmed install command for Stillos Ratings MCP yet — follow the setup steps linked from its listing page rather than a guessed package name.