Loading…
A field:value query language for the MCP server directory. Stack filters to pinpoint Model Context Protocol servers by security posture, transport, capability, tool surface, and infrastructure — the way a search engine indexes the web, applied to MCP.
auth:none transport:sseUnauthenticated legacy SSE serversauth:none grade:FNo-auth servers graded Ftool:sql auth:noneNo-auth servers exposing a SQL toolgrade:A verdict:GRADEDFully-assessed, A-graded serverscapability:resources -auth:noneResource servers that require authsdk:fastmcp sort:recentFastMCP servers, newest firstEvery term is field:value. Terms combine with AND; prefix a term with - to negate it (-auth:none); quote values with spaces (category:"developer tools"); and any bare words become a free-text match over names, descriptions, and tool names. Unknown fields are ignored, so a query never errors.
auth:auth:none | required | oauth | apikey | bearerFilter by the authentication surface. auth:none finds servers that enumerate with no credentials; auth:oauth / auth:apikey / auth:bearer match the detected scheme.
transport:transport:http | streamable-http | sse | stdioFilter by the negotiated transport. http and streamable-http are aliases for the modern Streamable HTTP transport; sse is the legacy HTTP+SSE line.
grade:grade:A | B | C | D | FFilter by the leading letter of the MCPGrade security band, so grade:A matches A, A- and A+.
gradeScore:gradeScore:>N | >=N | <N | <=N | NFilter by the 0–100 numeric score behind the letter grade using a comparison operator.
verdict:verdict:GRADED | N | T | UFilter by the non-numeric verdict: GRADED (fully assessed), N (auth-gated, graded on its auth surface), T (invalid TLS), U (unreachable).
capability:capability:tools | resources | promptsFilter by an advertised MCP capability key. capability:resources finds servers that expose readable resources.
tool:tool:<name>Match servers that expose a tool whose name contains the term — the substrate for finding, say, every server exposing a raw SQL tool.
country:country:US (ISO-3166 alpha-2)Filter by the country of the endpoint's resolved IP address (offline geo-lookup, populated as servers are re-scanned).
asn:asn:13335Filter by the autonomous-system number hosting the endpoint — e.g. asn:13335 is Cloudflare.
sdk:sdk:<family>Filter by the detected server SDK family (fastmcp, modelcontextprotocol-ts, mcp-go, …), fingerprinted from the server banner and version.
category:category:<text>Match servers whose category contains the term.
sort:sort:grade | recent | nameOrder the results — by security grade (default), most recently scanned, or name.
MCP dorks are a field:value search language for the MCP server directory, inspired by search-engine operators. You combine filters like auth:none, transport:sse, grade:A, tool:sql_query, and country:US to pinpoint Model Context Protocol servers by their security posture and infrastructure.
Plain text searches names and descriptions. Dorks filter on structured, fingerprinted attributes we capture during a read-only scan — the authentication scheme, transport, protocol era, advertised capabilities, exact tool names, SDK, and the resolved country/ASN — and they stack, so auth:none transport:sse country:US narrows to one precise slice.
No. Dorks query our existing directory of previously graded servers. Every grade comes from a strictly read-only inspection that never invokes a tool, and the search itself only reads our own database.