Loading…
A free, public, read-only API over the MCPGrade dataset: look up any server's A–F security grade, browse the graded MCP server directory, and embed a live grade badge. No key required — CORS is open, so you can call it straight from the browser.
Every endpoint lives under https://andraxpentester.in/api/v1. All responses are JSON (the badge endpoint returns SVG), all methods are GET, and CORS is open (Access-Control-Allow-Origin: *) because these are public read surfaces meant to be embedded and hot-linked. The API is entirely read-only — it never triggers a live scan, so it is safe to call from a badge <img> or a CI job.
Authentication is optional. Without a key you get the free tier: 60 requests per minute per IP address. With a valid key you get 600 requests per minute, keyed to the key rather than your IP. A key never changes the data you can read — only the rate.
Keyless (free)
60 req/min
Per IP. Nothing to sign up for — just call the endpoint.
Send your key in either header:
Authorization: Bearer mcpg_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
# ...or:
X-Api-Key: mcpg_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxKeyed responses carry an X-RateLimit-Tier: key header. When you exceed a limit the API replies 429 with a Retry-After header (seconds to wait). An invalid or unknown key is not an error — the request simply falls back to the keyless tier.
/api/v1/mcp/gradeLook up the latest cached MCPGrade for one server, by canonical name or by endpoint URL. Serves the persisted grade only — it never triggers a live scan. Returns 400 if neither parameter is supplied and 404 if no published, listed server matches.
Query parameters
| Param | Required | Description |
|---|---|---|
server | No | The server’s canonicalName (e.g. io.github.github/github-mcp-server). Provide this or endpoint. |
endpoint | No | The server’s remote endpoint URL. Canonicalized and matched against listed servers. Provide this or server. |
Example response
{
"ok": true,
"server": "GitHub MCP Server",
"slug": "github-mcp-server",
"canonicalName": "io.github.github/github-mcp-server",
"grade": "A-",
"score": 87,
"verdict": "GRADED",
"algorithm_version": "mcpgrade-1.4.0",
"scanned_at": "2026-08-18T22:14:05.000Z",
"findings": [],
"tool_count": 42,
"last_scanned_at": "2026-08-18T22:14:05.000Z"
}curl
curl "https://andraxpentester.in/api/v1/mcp/grade?server=io.github.github/github-mcp-server"JavaScript (fetch)
const res = await fetch(
"https://andraxpentester.in/api/v1/mcp/grade?server=io.github.github/github-mcp-server"
);
const data = await res.json();
console.log(data.grade, data.score); // "A-" 87/api/v1/mcp/serversA paginated, searchable list of published, publicly-listed MCP servers with their grades. Add ?facet= to get group-by counts over the current query instead of a page — useful for building filter UIs without paging the whole directory.
Example facet response (?facet=grade)
{
"ok": true,
"facet": "grade",
"counts": [
{ "value": "A", "count": 21 },
{ "value": "B", "count": 44 },
{ "value": "C", "count": 33 },
{ "value": "unrated", "count": 12 }
]
}Query parameters
| Param | Required | Description |
|---|---|---|
q | No | Case-insensitive substring filter over name, description, canonicalName and category. |
facet | No | Return group-by counts instead of a page. One of: grade, transport, auth, category. |
page | No | Page number, 1-based. Default 1. |
pageSize | No | Rows per page, 1–100. Default 24. |
Example response
{
"ok": true,
"page": 1,
"pageSize": 24,
"total": 137,
"totalPages": 6,
"servers": [
{
"name": "GitHub MCP Server",
"slug": "github-mcp-server",
"canonicalName": "io.github.github/github-mcp-server",
"grade": "A-",
"score": 87,
"verdict": "GRADED",
"transport": "STREAMABLE_HTTP",
"requiresAuth": true,
"category": "developer-tools",
"lastScannedAt": "2026-08-18T22:14:05.000Z"
}
]
}curl
# Paginated listing
curl "https://andraxpentester.in/api/v1/mcp/servers?q=github&page=1&pageSize=24"
# Free facet counts
curl "https://andraxpentester.in/api/v1/mcp/servers?facet=grade"JavaScript (fetch)
const res = await fetch("https://andraxpentester.in/api/v1/mcp/servers?facet=grade");
const { counts } = await res.json();
// [{ value: "A", count: 21 }, { value: "B", count: 44 }, ...]/api/v1/mcp/badge/{name}Returns a flat, shields-style SVG security badge — “MCP Security: <grade>” — for the server whose canonicalName is {name} (URL-encoded). Colour-coded by grade. Cached for an hour at the edge, with open CORS, so it can be hot-linked from any README. An unknown server renders a grey “unrated” badge rather than an error, so the embedding <img> never breaks.
Query parameters
| Param | Required | Description |
|---|---|---|
name | Yes | Path segment: the server’s canonicalName, URL-encoded (canonical names contain a slash, so encode it as %2F). |
curl
curl "https://andraxpentester.in/api/v1/mcp/badge/io.github.github%2Fgithub-mcp-server"/api/v1/healthLiveness probe. Returns 200 with a timestamp when the API and its database are reachable, or 503 when the database check fails.
Example response
{
"status": "ok",
"timestamp": "2026-08-19T10:30:00.000Z"
}curl
curl "https://andraxpentester.in/api/v1/health"Show your MCP server’s live security grade in its README, docs, or landing page. The badge is a plain <img> that re-renders as the grade changes — no build step, nothing to keep in sync.
Recommended — badge linked to its report
Wrap the badge in a link back to the server’s full report page. Readers can click through to the complete grade breakdown, and the link doubles as a verifiable citation of the grade. This is the form we recommend everywhere.
Markdown
[](https://andraxpentester.in/mcp-servers/github-mcp-server)HTML
<a href="https://andraxpentester.in/mcp-servers/github-mcp-server">
<img src="https://andraxpentester.in/api/v1/mcp/badge/io.github.github%2Fgithub-mcp-server" alt="MCP Security grade" />
</a>Bare image (no link)
If you only need the image, point an <img> straight at the badge endpoint. Prefer the linked form above where you can.
HTML
<img src="https://andraxpentester.in/api/v1/mcp/badge/io.github.github%2Fgithub-mcp-server"
alt="MCP Security grade" />Replace io.github.github%2Fgithub-mcp-server with your server’s URL-encoded canonicalName and github-mcp-server with its report slug — both appear on the server’s directory page and in the grade response.
The grade behind every response follows the published MCPGrade methodology (mcpgrade-1.4.0). See the scanning policy for what the scanner does and does not do, browse the server directory, or scan a server yourself from the MCP security scanner.