How MCPwell badges work
Connection Confirmed and Verified are checks, not placements. Neither badge can be bought. Auth required is a note, not a badge.
On 2026-10-19 the nightly probe covered 24,703 remote HTTPS URLs. 12,419 answered both initialize and tools/list. 6,093 returned HTTP 401 with WWW-Authenticate. 2,634 did not respond. 12,331 listings currently show Connection Confirmed. 48 listings are Verified. 5,984 listings show the Auth required note. Filter the list: Connection Confirmed, Verified.
Connection Confirmed
On the printed date, the public HTTPS URL on the fact sheet answered MCP initialize (HTTP 200, valid JSON-RPC result) and then tools/list (HTTP 200, valid result). The display line is “Connection Confirmed · YYYY-MM-DD · N tools · transport”.
The check sends no credentials and never sends tools/call. It is the same pair of methods as the tester, run from MCPwell rather than from the visitor's browser. A browser test can still fail when the server does not send CORS headers.
The line is removed after two consecutive failed nightly probes, or when the last success is more than 7 days old. One failed night keeps the previous success. Remote endpoints only. A stdio listing shows no connection line.
Auth required
Requires sign-in (HTTP 401 with WWW-Authenticate on the printed date). We send no credentials, so we did not list its tools. This is a note, not a badge, and not a quality signal. It is not shown as a failure and it is not a filter.
Verified
All three are required. Connection Confirmed within the last 7 days. The endpoint or package is tied to the listed source: the endpoint host matches a DNS or HTTP-authenticated registry namespace domain (a reverse-DNS name such as com.example/*, not a GitHub io.github namespace), or the listed homepage links the endpoint, or the npm or PyPI package repository field matches the listed GitHub repository. Install, transport, and auth on the fact sheet were reviewed on a printed date.
Verified means we confirmed this listing points at the publisher's own working endpoint or package. It does not mean the server is safe. It is not a security review. It is not an endorsement.
What a payment changes
Paid listings (Sponsored, then Featured) appear first in every list, marked Advertisement. Organic listings follow, sorted by GitHub stars. Paying doesn't change a server's GitHub stars, third-party ratings, Verified status, Connection Confirmed status, or listing data. Neither badge can be bought. A Sponsored or Featured placement does not add Connection Confirmed or Verified, and it does not remove them.
What we do not do
- We do not send
tools/call, a token, a cookie, or any other credential. - We do not treat HTTP 401 with
WWW-Authenticateas a failed server. - We do not print a connection line on a stdio-only listing.
- We do not let these badges add index-score points beyond the original probe file. The indexed set is unchanged by this label.
- We do not sell either badge.
The short version is on the badge page. Run a check yourself on the tester.