Each MCP server is run through the gauntlet: a live LLM agent attempts generated tasks using only the server's tools, alongside schema, description, security, reliability, and robustness checks. Grade is the weighted overall; a critical security finding caps it.
| # | Server | Grade | Score | Task success | Security | Tools |
|---|---|---|---|---|---|---|
| 1 | good-fixture | A | 99.4 | 100 | ✓ | 3 |
| 2 | sqlite | A | 95.5 | 83 | ✓ | 6 |
| 3 | memory | A | 95.4 | 83 | ✓ | 9 |
| 4 | time | A | 95.2 | 83 | ✓ | 2 |
| 5 | everything | B | 89.4 | 67 | ✓ | 13 |
| 6 | bad-fixture | C | 75.0 | 67 | ⚠ | 5 |
| 7 | git | C | 72.5 | 17 | ✓ | 12 |
| 8 | filesystem | D | 67.3 | 0 | ✓ | 14 |
Agent model: gemini:gemini-flash-latest · generated 2026-07-24T20:31+00:00 · scores from a live agent are stochastic (repeated and averaged); ⚠ = static tool-poisoning in a description (caps the grade), ⚡ = injection in a live tool output (does not cap).
These servers were not measured the same way as the ranked ones — the agent either never scored them, or stopped partway when a tool hung. Either way their score rests on a different basis: the overall is a weighted mean over the dimensions present, over however many runs completed, so a missing Agent Task Success (the heaviest dimension) or a short sample inflates the number relative to the ranked table. Each row says which applied.
| # | Server | Grade | Score | Task success | Security | Tools |
|---|---|---|---|---|---|---|
| — | fetch | A | 100.0 | — | ✓ | 1 |
| no read-only tools to test (all excluded as possibly-mutating) | ||||||
| — | sequential-thinking | A | 100.0 | — | ✓ | 1 |
| no read-only tools to test (all excluded as possibly-mutating) | ||||||