Verification methodology
Thousands of public MCP servers exist; very few carry any trust signal. The Neura Verified badge means the server's claimed manifest passed our published, point-in-time security scan pipeline. Here is exactly what it covers — and what it doesn't.
The scan pipeline
The submitted manifest is hashed (sha256 per file + whole archive) and checked for junk padding and empty submissions.
Rule-based detection of embedded API keys, tokens, private keys, and credential material.
Pinned dependencies are checked against the osv.dev advisory database.
Static analysis for dangerous patterns: eval/exec of remote content, shell piping, obfuscated payloads.
Heuristic rules plus an LLM audit with a fixed rubric: external code fetch, credential access, exfiltration to undeclared destinations, prompt-injection payloads.
Every host referenced in the manifest is diffed against the declared domain list — undeclared egress becomes a finding.
Trust score
Every completed pipeline yields a 0–100 trust score: 100 minus deductions for each finding in the latest scan of each type — CRITICAL −40, HIGH −15, MEDIUM −5, LOW −1. The score is shown next to the badge in the directory.
Tiers
- Scanned — the full automated pipeline completed with no critical or high findings.
- Neura Verified — scanned, plus reviewer confirmation of publisher repository ownership and scan interpretation.
- Verified+ — adds a manual reviewer walkthrough of the server's tool surface and permissions.
Scope and honesty
Verification is point-in-time against the manifest the publisher submitted. It is not a continuous runtime audit of the deployed server, and it expires (12 months by default) unless re-certified.
A verified badge is evidence, not a guarantee. If a verified server is later compromised or changes behavior, the badge can be suspended and the incident noted publicly.
Verification is only available to publishers who claim ownership of the server's repository.