Loading…
Independent build-vs-buy index that scores software categories as Build, Buy, Bridge, or Beware.
Do not connect
The assessed surface is high-risk. Remediate the findings before connecting.
Scanned 1 month ago Due for re-check
A server can change after it's graded. Re-run the automated scan to refresh this report.
This grade is deterministic and reproducible: the same server surface always yields the same grade under a given algorithm version. It is a real automated assessment computed by the MCPGrade engine from what the probe actually observed — not a fabricated or opinion score. It is not a manual human pentest, so it can miss context-specific risks.
Every signal below was measured directly by the automated probe. The grade is derived only from evidence like this — nothing is assumed.
The b4-index MCP server exposes 5 tools, focused primarily on general-purpose capabilities. Its published description reads: "Independent build-vs-buy index that scores software categories as Build, Buy, Bridge, or Beware". It communicates over Streamable HTTP using the 2025-06-18 protocol revision, and does not require authorization to connect. MCPGrade currently rates b4-index D- — the assessed surface is high-risk and should be remediated before use. Its most notable findings include "Cross-tool shadowing" and "Cross-tool shadowing". This report is a deterministic, reproducible automated assessment: the same observed surface always yields the same grade under a given algorithm version, and it is refreshed as new scans arrive and free to read — but it is not a substitute for a manual human security review. Always re-check b4-index's advertised tools, transport security, and authorization posture before connecting an autonomous agent or sharing sensitive context with it.
Add b4-index to an MCP client using the endpoint below. Review the grade and findings above before granting an autonomous agent access.
MCP endpoint
https://b4-index.vercel.app/mcpStreamable HTTP transport. This is the MCP endpoint, not a website — paste it into your MCP client server list rather than a browser.
Captured passively during the read-only scan. Click any value to find servers that match it.
The tools this server advertises via tools/list — names, purposes, and the parameters each accepts, exactly as enumerated read-only.
Search and filter the B4 Index's 1,600+ independently scored software categories. Browse by keyword, domain, quadrant, or industry. When filtering by industry, returns all vertical categories for that
Score a software category using the B4 Index. Provide a known category name to get pre-computed scores, or provide raw dimension scores (1-5 each) for a custom evaluation. Returns the banded verdict (
Analyze a software stack against the B4 Index. Provide a list of tool/category names, and get per-tool banded verdicts plus a portfolio summary with verdict distribution, BEWARE spend, near calls, and
Compare build vs buy for a specific software category. Returns side-by-side analysis with the category's banded verdict, scores, vendor options, AI replacement approach, and action steps for each path
Get B4 Index recommendations from a natural language description of a software need or business context. Matches the description to relevant categories and returns top matches with scores, banded verd
Sorted worst-first. Each finding shows its severity, what it means, its OWASP MCP Top-10 mapping, and a recommended fix — the check id links to the exact methodology row that produced it.
tool: b4_audit
A tool description tries to alter the model’s use of another tool.
free tools are b4_browse and b4_score.]RecommendationDescriptions must describe only their own tool.
tool: b4_compare
A tool description tries to alter the model’s use of another tool.
free tools are b4_browse and b4_score.]RecommendationDescriptions must describe only their own tool.
tool: b4_recommend
A tool description tries to alter the model’s use of another tool.
free tools are b4_browse and b4_score.]RecommendationDescriptions must describe only their own tool.
The server accepts tool enumeration (and likely invocation) with no authentication.
RecommendationRequire OAuth 2.1 authorization for any server exposing non-public tools.
Validates up to 75,000 URLs per job checking status codes, redirects, and response times.
Pay-per-call AI API marketplace with 47 endpoints — OCR, TTS, LLM chat, image generation, weather, and crypto pricing — paid via x402 USDC micropayments on Base.
EPA drinking water quality data in plain English, providing AI agents with tap water quality information for US cities via nine public-data tools.
AI phone answering and appointment booking tools for service businesses.
Aggregates Romanian TV, streaming, cinema, and theater listings for AI agents.
Agent-callable Parallax services — catalog browsing, pricing, project start, and booking.