Catalogue records
The wider catalogue includes automatically collected product and repository information. Descriptions, pricing categories, relations and setup snippets can be incomplete or outdated. Inclusion is not an endorsement, a security assessment or proof of compatibility. We retain these records for discovery and label them separately.
Source-reviewed guides
Guides with current editorial source reviews each have a dated review, a named editorial owner, primary documentation, a specific use case, limitations, deployment considerations and a suggested first task. We check the documentation behind those statements. Generated copy alone cannot qualify a record for this collection.
What “tested” would mean
A successful test needs a recorded task, tool version, host, date and result. Source review is not installation testing. Suggested exercises and client names imported into catalogue records do not count as test receipts. We do not apply a tested badge based on those fields.
Security check (static checks)
An MCP server can carry a security check: static checks of what is published about it. We never install or run its code for this. We look up advisories for its npm or PyPI package on OSV, read the repository licence on GitHub, look for credentials written into the documented setup, and list the environment variables it asks for and, once our lab has installed it, the tools it offers. The result is a number out of 100 with every finding, its severity and the date of the check. It is not a security assessment or an audit. A server can be unsafe in ways no published information shows, so read the findings, not just the number.
A skill, rules file or AGENTS.md can carry a security check too. We read its own files as text: the instructions, and the scripts, settings and dependency lists in its folder. We never install or run them. We look for code that downloads and runs something straight away, hidden or encoded content, reads of stored credentials, data sent to hosts outside the well-known APIs, and instructions that tell the agent to override you or skip its permission prompts. We look up its pinned dependencies on OSV and check every package it names against the list of known malicious packages. Each finding names the file and line. A skill with no findings has passed these checks, which is not the same as being safe.
How recommendations are ordered
Only current source-reviewed guides qualify for editorial shortlists. Within that set, explicit featured picks come first, followed by available GitHub popularity and maintenance signals. Stars describe repository popularity, not fitness for your task. A parent repository's popularity does not establish the maturity of every component inside it.
Dates and maintenance
Source review dates describe when documentation was checked. Repository activity, metadata imports and publication dates are different signals. A build does not refresh a review date. Reviews older than 45 days leave current recommendation lists until their sources are checked again. They remain readable with a review-due label.
Costs and licences
Hosted plans, model usage and self-hosting costs can differ. We describe the access route and link to current terms rather than inventing a subscription price. Public source code and an unrestricted open-source licence are different things. Check the actual licence for your intended use.
Comparisons and related tools
The comparison tool puts the same practical questions side by side. Related tools may complement each other instead of being direct replacements. Automatically inferred catalogue relations are discovery suggestions, not verified switching guides.
Your shortlist
Saved tools are stored in this browser on this device. No account is required and the list is not synchronised between devices. Clearing browser storage clears the list. Comparison URLs contain selected public tool identifiers and can be shared.
Corrections
If an entry is wrong, include its URL and the supporting documentation in a correction submission. Important facts should be confirmed with the original vendor before relying on them.