Badge
A badge that only says what the last scan proved.
The MCP registry has no security field, so users cannot tell a tested server from an untested one. The badge fills that gap honestly: it is earned by a verified, hosted scan, it links to the evidence, and it goes grey when the evidence gets old.
Four states
| Badge | What it means |
|---|---|
| mcpprobepassing | The latest hosted scan found nothing at or above your fail-on severity, and it ran within the last 30 days. |
| mcpprobefailing | The latest hosted scan found at least one finding at or above your fail-on severity. |
| mcpprobestale | The last clean scan is more than 30 days old. A badge that cannot be refreshed stops vouching for you. |
| mcpprobeunknown | No verified target with that host exists, or it has never completed a hosted scan. |
What it proves, and what it does not
A passing badge proves three things: someone who controls the host verified it, a hosted scan ran the checks that apply to it within the last 30 days, and none of them failed at the owner's chosen severity.
It does not prove the server is secure. Governance items cannot be tested from outside, heuristic checks can be wrong, and a server can change after a scan. That is why the badge links to the full report rather than standing on its own.
How it is earned
- Verify the host with a DNS TXT record.
- Run a hosted scan, or let the schedule run one.
- Embed the snippet. The image and the report page update after every scan.
Embed it
[](https://mcpprobe.tech/r/your-server.example)<a href="https://mcpprobe.tech/r/your-server.example">
<img src="https://mcpprobe.tech/badge/your-server.example.svg" alt="mcpprobe security scan status" height="20">
</a>Directories and registries can read the same state as JSON from /api/v1/status/{host}; see the API docs. Try the live endpoints for the demo host: badge SVG · status JSON.
