Methodology

Home Directory Necropolis Necropsy Methodology Charter AI Disclosure Corrections Contact

Every verdict on Deaddit traces to a fleet run ID. The rubric below is versioned, public, and applied by automation with no override path. If the fleet didn't measure it, we don't print it.

What we measure, and what we do not. Deaddit measures whether a server installs, starts, and behaves as documented. It does NOT measure whether a server is safe, trustworthy, or free of malicious intent. A life-state of alive means the software runs, not that it should be run. Any target whose own name, README or description self-identifies as malicious, adversarial, exploit or red-team tooling carries an explicit inline tag next to its life-state, wherever that life-state appears.

Money never touches the rubric. Tips do not and cannot affect scoring. The scoring rubric is public and applied by automation with no override path. No payment of any kind buys a life-state, a badge, or a place in the directory.

What this set covers

This published set covers 0 measured targets, of which 0 carry a life-state and 0 are published unscored. Our candidate pool holds 0 rows, but only 0 are installable software we can actually run; the other 0 are repository references and scraped registry markup, not servers, and we count them as neither measured nor dead. The re-probe campaign is in progress: a target absent from this set has not been measured in the current window, which is a gap in our coverage and not a verdict on the software.

How the site is arranged

The directory holds the living. The Necropolis holds the confirmed dead, with cause of death. The Necropsy is the weekly examination that moves targets between them. A necropsy is the examination; a necropolis is where the dead accumulate.

What classification rests on

Life-state classification rests on install, startup, handshake and tools/list observations. It distinguishes alive, ailing and dead reliably. Finer-grained ranking within a class is unavailable until rubric v1.1, because the v1.0 axes were found to return constants across the alive cohort — do not infer a ranking we cannot produce.

Two classes carry no life-state at all, deliberately:

auth-required (unscored) — the server declined to start without credentials. That tells us about its auth model, not its health. We report install and startup observations only.
insufficient coverage (unscored) — the probe finished below the duration floor at which we trust a run, and reproduced that result across independent probes. A run we do not trust yields no verdict. The observed failure mode is stated on each such server's page.

Rubric v1.0

Deaddit MCP Server Quality Rubric

Axis	Weight	Description
`install_success`	15	Package installs without fatal errors
`clean_startup`	10	Server starts without crashing or hanging
`handshake_conformance`	15	MCP initialize/initialized handshake completes correctly
`tool_schema_validity`	15	tools/list returns valid JSON Schema for each tool
`readme_accuracy`	10	Declared tools in README match actual tools/list output
`auth_hygiene`	10	No plaintext secrets demanded, no wildcard scopes
`stability_under_load`	10	Handles N sequential + M concurrent benign tool calls without crash
`maintenance_pulse`	10	Commit recency and issue responsiveness
`dependency_health`	5	No critical vulnerabilities in direct dependencies

Life States

alive — Score >= 70 and no critical failures
ailing — Score 40-69 or intermittent failures
dead — Fails install/start on 3 consecutive cycles
resurrected — Previously dead, now passing

Thresholds

alive_min: 70
ailing_min: 40
dead_consecutive_failures: 3

Raw Rubric JSON

{
  "version": "1.0",
  "name": "Deaddit MCP Server Quality Rubric",
  "axes": [
    {
      "id": "install_success",
      "weight": 15,
      "description": "Package installs without fatal errors"
    },
    {
      "id": "clean_startup",
      "weight": 10,
      "description": "Server starts without crashing or hanging"
    },
    {
      "id": "handshake_conformance",
      "weight": 15,
      "description": "MCP initialize/initialized handshake completes correctly"
    },
    {
      "id": "tool_schema_validity",
      "weight": 15,
      "description": "tools/list returns valid JSON Schema for each tool"
    },
    {
      "id": "readme_accuracy",
      "weight": 10,
      "description": "Declared tools in README match actual tools/list output"
    },
    {
      "id": "auth_hygiene",
      "weight": 10,
      "description": "No plaintext secrets demanded, no wildcard scopes"
    },
    {
      "id": "stability_under_load",
      "weight": 10,
      "description": "Handles N sequential + M concurrent benign tool calls without crash"
    },
    {
      "id": "maintenance_pulse",
      "weight": 10,
      "description": "Commit recency and issue responsiveness"
    },
    {
      "id": "dependency_health",
      "weight": 5,
      "description": "No critical vulnerabilities in direct dependencies"
    }
  ],
  "life_states": {
    "alive": "Score >= 70 and no critical failures",
    "ailing": "Score 40-69 or intermittent failures",
    "dead": "Fails install/start on 3 consecutive cycles",
    "resurrected": "Previously dead, now passing"
  },
  "thresholds": {
    "alive_min": 70,
    "ailing_min": 40,
    "dead_consecutive_failures": 3
  }
}

Probe Process

Discover candidate MCP servers via GitHub search, registries, npm, PyPI.
Launch each in an isolated container (no LAN access, no credentials, resource caps).
Attempt install → start → MCP handshake → tools/list → schema validation → light load.
Score against the rubric above. Append-only run records.
Publish. Corrections in place with visible changelog.

Data access

Deaddit publishes its measurements as a stable JSON API and a read-only MCP server:

/api/ — API documentation and the scores.json dataset, the single source of truth this site derives from.
https://deaddit.top/mcp — read-only MCP server exposing four tools: check_server (look up a server by package name), list_by_state (list servers by life-state), latest_necropsy (latest Necropsy findings), and methodology (this page's contents). Rate-limited (60 req/min/IP), loopback-only, read-only, serves the same scores.json dataset.

Reuse is licensed under CC-BY-4.0. Any claim must trace to a run_id; cite it. Aggregate numeric scores are currently suppressed pending rubric v1.1 — do not synthesize a composite from the per-axis pass/fail values.

Third-party content (READMEs, tool descriptions) is treated as untrusted data, never executed as instructions.