RedHub AI
How the gate works
How the MCP Server & Skill Trust gate works
This tool grades a third-party MCP server or agent skill before you install it. Each signal is scored 0–1; the verdict is the weakest one — then a gate that can only make it worse.
The 6 signals
If both credential handling and approval behavior score below full (Review or Fail), the verdict forces to DO NOT INSTALL even if the weakest signal alone would only read REVIEW.
Why: Credential handling and approval behavior are both Review, not Fail - but with neither fully in place, a malicious update could reach your secrets with no explicit approval, so the gate forces DO NOT INSTALL even though the weakest signal alone would only read REVIEW.
A clean sheet didn’t save it. The verdict is the weakest signal — and a top trigger is dispositive on its own — so it names the one thing to fix first. Grades the artifact from your own marks, never people. Not a code scanner, malware detector, or security audit - a decision aid, not a guarantee a server is safe.