Safety ratings · rs-safety-checks-2.0
Public-signal checks for npm, PyPI, skills and MCP servers
Automated checks of public signals as of the date shown. Not a security audit, certification or endorsement, and not a statement about the people who maintain the project. Signals can be incomplete or out of date; each check shows its evidence and source so anyone can verify it.
Every score comes from fixed published rules (methodology), no AI, and is sealed on the ledger with its date. GitHub repositories: /safety-ratings.
| Kind | Entry | Score | Signals | As of |
|---|---|---|---|---|
| npm | openai | 100 | Strong public signals | 2026-11-02 |
| npm | @anthropic-ai/sdk | 90 | Strong public signals | 2026-11-02 |
| npm | @modelcontextprotocol/sdk | 90 | Strong public signals | 2026-11-02 |
| pypi | fastmcp | 88 | Strong public signals | 2026-11-02 |
| pypi | mcp | 81 | Good public signals | 2026-11-02 |
| pypi | openai | 80 | Good public signals | 2026-11-02 |
| mcp | io.github.github/github-mcp-server | 67 | Moderate public signals | 2026-11-02 |
| mcp | com.a2ally/a2ally | 53 | Moderate public signals | 2026-11-02 |
Not rated yet?
An unlisted entry is simply not rated yet — never a negative finding. Request a free check: POST /v1/ratings/{kind}/{id}/recheck.