Facts mcp-audit publishes about 50 known MCP servers: verification status, known CVEs, declared capabilities. Facts, not grades — a package's risk depends on how you deploy it. Every page here is also JSON.