Reference
Quality grades
Every server in the vault carries a letter grade from A to F. The rubric is fully public because a grade you cannot audit is just an opinion. Grades are computed from objective public repository signals, recomputed as we re-index, and cannot be edited, bought or improved by anything except improving the project itself.
The rubric
Four signals, eight possible points:
Maintenance recency0 to 3 pts
Pushed within 30 days: 3 points. Within 90 days: 2. Within 180 days: 1. Older: 0. The heaviest signal, because an unmaintained connector to live data is a liability.
Adoption0 to 3 pts
500+ stars: 3 points. 100+: 2. 20+: 1. Stars are a lagging, gameable metric on their own, which is why they are only one signal of four here.
License clarity0 to 1 pts
A real SPDX license: 1 point. No license or NOASSERTION: 0. You should not connect tools with unclear legal status to production data.
Documentation0 to 1 pts
A meaningful description (more than a placeholder): 1 point. A project that cannot describe itself in a sentence usually has bigger gaps.
Grade thresholds
Actively maintained, adopted, licensed, documented. Safe bet.
Healthy project with a minor gap, often just lower adoption.
Middling signals. Read the repository before relying on it.
Weak signals: stale, unadopted or undocumented. Eyes open.
No positive signals, or the repository is archived. Archived always means F.
How to read a grade
A grade is a health snapshot of the project, not a review of the code. An A-grade server is being maintained by someone whose work other people use, under a clear license, with real documentation. That correlates strongly with quality, but it is not proof the server works. Proof is what the verified badge is for: grades measure signals, verification measures behavior.
What grades do not measure
Grades do not measure security, performance or fitness for your use case. A well-maintained server can still request broader permissions than you want to give it. Read the tool list on the listing to see exactly what the server can do, and treat any server you connect to sensitive data with the same care as any other dependency.