How to choose an MCP server

You found three MCP servers that do roughly the thing you need. Now what?

The honest answer is that most of the signals people reach for first are the weakest ones. Star counts are the obvious example. In a snapshot of 15,473 published MCP servers taken on 2026-08-25, only 7,343 of them carry a star count at all, so ranking by stars silently drops half the ecosystem before you have compared anything. The median among those that do have one is 1 star. The top of the distribution has 69,310. There is nothing in between worth calling a signal.

Here is what to check instead, in the order that eliminates candidates fastest.

Does it still exist?

Start here, because it is cheap and it removes more candidates than anything else. Open the repository. If it 404s, you are done.

That sounds too obvious to say. It is not: 2,476 of the servers in the corpus declare a repository URL that GitHub answers with a 404. The link is in the registry, the registry entry looks fine, and the code is gone. Public lists inherit those entries and can keep showing them unless they re-check the link after ingesting it.

Separately, 5,154 servers have no repository at all. They are remote-only: a hosted endpoint you call, with no source to read. That is not a defect, plenty of good commercial services work that way, but it means every check below that depends on a repository will come back empty for them, and you should notice that rather than reading the blanks as clean bills of health.

When was it last touched?

Take the last commit date on the default branch and subtract today. Under a month is active. One to six months is slow, which is fine for a small tool that works. Six months to a year is dormant. Over a year, or an archived repository, or a registry entry marked deprecated, is abandoned.

Of the servers where this is knowable, 78.7 % are active or slow and 21.3 % are dormant or abandoned. But it is only knowable on half of them. For the other half there is no repository to read, and no signal in either direction. A missing maintenance signal is not a mark against a project. It is an unpriced risk, and the difference matters when you are the one pricing it.

One trap: recent commits do not undo a deprecation. If the official registry says a server is deprecated, it is deprecated, whatever the commit log says.

Can you actually ship it?

This is the check people skip and then discover in a review three months later.

Read the licence, not the badge. Of the corpus, 51.0 % of rows carry a licence that resolves to a real SPDX identifier. Of those, 96.4 % are permissive and MIT alone is 82.2 %, so the odds are good once a licence resolves at all. The problem is the other 49.0 %, where nothing resolves.

An absent licence is not a permissive one. "No LICENSE file" means all rights reserved by default in most jurisdictions, and a repository that reads NOASSERTION on GitHub or SEE LICENSE IN LICENSE on npm has told you nothing. Those are absences, not licences, and any tool that maps them to "probably MIT" is guessing on your behalf about something with legal consequences.

The copyleft family is its own question, and it is a question about you rather than about the server. Whether AGPL or GPL permits your use depends on how you ship: internal tool, hosted service, distributed binary. There is no universal answer, so treat any dataset that gives you one as wrong.

There is more on this on the licences page.

What does it need before it runs?

Three answers, and they cost very different amounts of your time.

Nothing at all: 59.7 % of servers declare no required secret. You install it and it works. An API key: 31.2 %. You now need somewhere to put a secret, which means a secrets manager or at minimum a decision about where it lives. OAuth: 1.2 %, and that is a real integration with a redirect flow, not a config line.

The remaining 7.9 % declare nothing machine-readable at all. Treat those as requiring credentials until you have proved otherwise, not as open. Absence of evidence is not evidence of no auth wall.

How does it install, and where does the data go?

npx covers 43.3 % of the corpus and remote covers 41.3 %, which is close to the whole ecosystem split in two. Those two options are not comparable on convenience alone.

A local npx server runs on your machine and your data stays there. A remote server is somebody else's endpoint, and every tool call you make sends them the arguments. That may be completely fine. It is still a decision, and it is the one most likely to be made by accident, because remote servers are the easiest ones to add.

docker (0.3 %), uvx (1.1 %) and manual (1.3 %) are rounding errors by count but often the right answer for anything you plan to run in production.

Is it actually five servers, or one server listed five times?

Many free MCP directories are organised around a single source or list, which makes cross-source duplicates easy to miss. The same server can appear in several of them under different names, and a fork with two stars sits next to its parent looking like an independent option.

If you are comparing candidates across directories, check whether they resolve to the same repository or the same package coordinate before you treat them as alternatives. Otherwise you will spend an afternoon carefully evaluating one project three times.

What none of this tells you

None of the above is a security check. Nothing here reads the code, scans the dependency tree, or calls a tool to see what it does with the arguments you gave it. A server can be alive, permissively licensed, actively maintained, and still exfiltrate everything you pass it. Those are separate questions and they need a separate answer.

Be equally careful with the word "verified" wherever you see it, including on this site. In our dataset it means exactly two things: the server resolved at the snapshot date, and it is not a duplicate of another row. It does not mean audited.

If you would rather not do this by hand

The numbers above come from a 15,473-row snapshot of the public MCP servers we could find, taken on 2026-08-25. It carries all six checks as columns, so you can filter instead of clicking.

The free 50-row sample has every field and no email gate, and the full dataset is €4 snapshot or €10/month API.

Or do it by hand. Six checks, three candidates, twenty minutes. Just do the licence one.