What “verified” means here.

01. Acquire

The worker downloads an exact package version into a disposable container. Network access is restricted to the relevant npm or PyPI registry during this phase.

02. Disconnect

Before the server process starts, the container is disconnected from the network. It runs without credentials, host mounts, or inherited secrets.

03. Observe

The probe sends initialize, completes the protocol handshake, and requests tools/list. It records the protocol version, server information, tool names, schema digest, duration, and runner version.

04. Publish carefully

A success publishes immediately. An ordinary failure requires a second matching result at least 15 minutes later. Successful evidence becomes stale after 30 days without another success.

Limits of the observation

MCP Measure never calls a tool and does not review tool implementation, data handling, permissions, dependencies, or security. “Verified” must not be read as safe, secure, trusted, certified, or approved.