What does an MCP server security score mean?

An MCP server security score on MCPVault is a 0 to 100 number where lower is better: 0 to 20 is low risk, 21 to 50 caution, 51 to 80 high risk and 81 or more critical. The score adds up weighted findings from a static NVIDIA SkillSpector scan of the server's shipped code. Harvesting the whole environment scores 20 points, reading an SSH key or cloud credential file 15, a taint flow from an environment variable into a shell command 10, a subprocess call 6 and a local .env read 3. Each rule has diminishing returns, so one serious finding outweighs a pattern repeated a hundred times. Known-vulnerable dependencies add points per package and are capped at 30. A low score means nothing in the code looks like theft, exfiltration or hidden instructions. It is not a guarantee, so read the findings and the list of hosts the server talks to before granting it broad access.