Trust Scoring
Every MCP server deployed through Conduit is scanned for security vulnerabilities, compliance issues, and performance problems. Results are distilled into a trust score and grade used by MLSs to evaluate vendor access requests.
Five scoring dimensions
| Category | Weight | What it checks |
|---|---|---|
| Security | 40% | Tool poisoning, prompt injection, data exfiltration, command injection, path traversal, credential exposure |
| Compliance | 20% | MCP spec adherence, error handling, transport configuration, protocol version |
| Auth | 20% | Authentication mechanisms, TLS configuration, CORS headers, credential storage |
| Performance | 10% | Response latency, error rate, connection stability, throughput |
| Runtime | 10% | Gateway telemetry analysis (requires active Conduit deployment) |
Each category scores 0-100. The total score is the weighted sum, rounded to the nearest integer.
Grade scale
A+
95-100
A
90-94
B+
85-89
B
80-84
C+
75-79
C
70-74
D
60-69
F
< 60
13 finding categories
tool_poisoningTool descriptions contain hidden instructions or manipulation attemptsprompt_injectionTool outputs or resource contents contain injected promptsdata_exfiltrationTools attempt to send data to unauthorized external endpointscommand_injectionTool parameters allow arbitrary command executionpath_traversalFile operations allow access outside intended directoriescredential_exposureSecrets or credentials exposed in tool definitions or responsesauth_weaknessMissing or insufficient authentication/authorizationspec_violationNon-compliance with MCP protocol specificationtransport_issueTLS, CORS, or transport configuration problemsperformance_issueHigh latency, timeout, or error rateruntime_anomalyUnusual patterns detected in gateway telemetryhidden_contentHidden or obfuscated content in tool metadatacross_server_riskInteractions that could affect other servers or clientsSeverity levels
[!!]critical — Immediate exploitation risk. Server should not be used until resolved.
[! ]high — Significant security concern. Should be addressed promptly.
[~ ]medium — Moderate risk. Should be addressed in the next update.
[. ]low — Minor concern or best practice recommendation.
[i ]info — Informational. No action required.
Scan process
Scans are triggered on deploy, on schedule (based on plan), or manually:
bash
# Via API
POST /api/servers/:slug/scan
# Via CLI
conduit scan my-serverScans typically take 10-30 seconds. The scanner connects to your server, discovers tools, analyzes tool definitions and behaviors, and produces findings with scores.
Badge embeds
Display your trust score with embeddable SVG badges in three styles:
Standard
<img src="https://conduitapi.dev/api/badges/{serverId}" alt="Trust Score" />Compact
<img src="https://conduitapi.dev/api/badges/{serverId}?style=compact" alt="Trust Grade" />Markdown (for READMEs)
[](https://conduitapi.dev/trust/{serverId})Next: Data Governance →