How ranking works

The three signals

A directory that collapses everything into a single number is easy to read and easy to game. We keep the three things a buyer actually asks about apart, because they answer different questions and they fail in different ways.

User rating answers “did this work for people like me?”. Safety grade answers “will this do something I did not ask for?”. Market presence answers “am I the first person here?”. A server can be excellent on one and poor on another, and that is information, not a contradiction.

User rating

One to five stars, written by someone signed in with GitHub, one review per person per server. The number shown on a card is the plain average. The number used for ranking is smoothed toward the overall mean, so a server with one five-star review does not outrank one with twenty four-star reviews.

The smoothing is an ordinary Bayesian average: we treat every listing as if it started with three reviews at the site-wide mean, then let real reviews pull it away. Thirty honest reviews move it a long way; one does not.

Reviews from GitHub accounts younger than thirty days, and any review containing a link, wait for a human before they publish. Accounts older than ninety days are marked verified. Both facts are shown on the review itself, so you can weigh them yourself. The review guidelines spell out the rest.

Safety grade

A to F from our open scanner, re-run on every release. It reads the published code, probes the live endpoint, checks how the server authenticates, looks for instructions hidden in tool descriptions, and checks the repository is real and maintained. Every component and every finding is published on the listing, so you can disagree with the conclusion and still use the evidence.

A grade is not an opinion about quality. A beautifully built server with a stale repository will score lower than a dull one that ships every week. Read it as “what could go wrong”, not “how good is it”. The rubric has the point-by-point breakdown.

Components that could not be checked are left out of the denominator rather than given full marks. A remote-only server with no package to scan is graded on what we could actually verify, and the report says so.

Market presence

One number from zero to one hundred, built from public facts: GitHub stars, package downloads in the last week, how recently the repository was pushed, and whether the endpoint answers. Stars and downloads are log-scaled, so the difference between ten and a hundred counts for more than the difference between ten thousand and a hundred thousand.

Presence is a measure of how many other people have already hit the sharp edges. It is not a measure of quality, and we never let it override a rating or a grade.

How lists are ordered

Category pages and search results put reviewed servers first, ordered by the smoothed rating. Below them come the scanned-but-unreviewed servers, ordered by market presence. Below those, listings the scanner has not reached yet, newest first.

That order reflects what we trust most: what a person told us beat what a machine measured, and what a machine measured beats not knowing. When a section is empty, the page says so rather than padding it out.

What money cannot buy

There is no sponsored placement on this site, no paid listing tier, no advertising, and no way to pay for a better position in any list. A publisher who claims a listing can keep its details current and reply to reviews. They cannot delete a review, change a grade, hide a finding, or move themselves up a page.

If a ranking here ever looks bought, it is a bug and we would like to hear about it. The appeals process is the formal route for a finding you think is wrong.