Stillos Ratings MCP

What stillos-ratings-mcp MCP server does

stillos-ratings-mcp MCP server provides outside-in ratings for MCP operators before you install their software. It uses a public census of more than 7,000 operators and reports a grade, population rank, five scored dimensions, rail position, publisher and fleet concentration, and any dated finding recorded for a host.

The primary security signal concerns a tool surface that changed while the endpoint's version string stayed the same. The service compares anonymous tools/list observations from different times. If the tool list changes without a corresponding version change, a client that approved the earlier list may not have been asked to review the new tools.

A finding is an observation about change, not a claim of malicious intent. The ratings are percentile positions within the measured population, not an audit or security certification. An unrated host returns NOT_RATED; that indicates coverage limits, not that the host is safe.

How it works

The package is a thin client over GET https://stillosdigitalholdings.com/ratings/node?host=<host>. It does not require an API key, signup, or account, and the endpoint is described as free and unmetered. The underlying census is refreshed every six hours.

Each check_mcp_server response includes a receipt hash and a recompute link. The published methodology and public records allow the reported figures to be independently recomputed. Receipt verification establishes the integrity and timestamp of the sealed board; it does not establish that a rating is correct.

Fleet information adds structural context: the response identifies the publisher, the number of servers attributed to that publisher, and how many other servers share its core tool set. If the registry does not cover a host, concentration is reported as not measured rather than as evidence that the host is not part of a fleet.

Setup and configuration

Run the command-line package with npx:

npx stillos-ratings-mcp check api.mcp.ai
npx stillos-ratings-mcp findings
npx stillos-ratings-mcp compare api.mcp.ai some-other-host.com

To expose stillos-ratings-mcp MCP server tools to an MCP client, add a stdio entry using npx:

{
  "mcpServers": {
    "stillos-ratings": {
      "command": "npx",
      "args": ["-y", "stillos-ratings-mcp", "mcp"]
    }
  }
}

No credentials or environment variables are required according to the provided material. The package holds no credential, so its requests can be reproduced with curl against the public endpoint.

Tools and capabilities

• check_mcp_server: returns a host's grade, rank, five scored dimensions, rail position, publisher and fleet concentration, and any dated finding.
• list_tool_surface_findings: lists every operator currently carrying a dated tool-surface finding.
• compare_mcp_servers: compares as many as 10 MCP server candidates side by side.

These capabilities place the stillos-ratings-mcp MCP server in the Security category for pre-installation review. They are most useful when choosing among unfamiliar remote hosts or checking whether a candidate has a recorded tool-surface change.

Limitations and notes

The service only covers part of the public registry: the README reports 41.8% of distinct remote-declaring hosts as enumerated on 2026-10-04. Missing coverage is not a safety result. Likewise, no finding means only that this specific failure mode was not observed on that host.

Fleet concentration describes how a server appears to have been produced; it is not a judgment about good or bad faith. Ratings are not self-reported, but they remain measurements of the available public census. The tool does not claim to audit source code, certify operators, or provide a general clean bill of health.