How verification worksBeginner· 6 min read

What a Verified badge actually means

The one thing to remember

A badge is a record of what specific tests found on a specific version on a specific day. It is not a warranty.

The question

Understand what you are relying on when you trust a badge, so you can decide what you still need to check yourself.

Figure

How What a Verified badge actually means works, in one picture

The same argument as the text, as a chain. Each step is what makes the next one possible.

1
It applies to one version, not to the product
Verification runs against a single published version and records the hash of exactly what was tested. When the maker ships an update, the badge does not carry over. The listing drops to unverified until the new version has been through the same tests.
This matters more here than in most software categories. An MCP server describes its own tools to the model that calls it, so a maker who changes a tool description after you installed it has changed what the software does without changing anything you would notice.
A badge with an old date next to a recent update is the one combination that should stop you.
2
It covers the code, the dependencies and the declared behaviour
The verification panel on every listing page
The scan looks for credentials left in shipped files or in repository history, dependency versions with known published vulnerabilities, and whether the software does what its own manifest says it does.
That last check is the one people underestimate. A listing declares which tools it exposes, which scopes it needs and where it is allowed to send data. We compare the declaration against observed behaviour, and a mismatch fails the check even when neither half is dangerous on its own.
3
For MCP servers it adds the attacks specific to them
Any tool that accepts a URL is tested for whether it will fetch somewhere it should not. In a large independent scan of public MCP servers in 2026, more than a third of URL-accepting servers failed exactly that check.
Tool descriptions are tested for injected instructions, which is the attack behind the tool-poisoning vulnerabilities disclosed in 2025. Servers that expose command execution are tested for whether the command set is fixed or open ended.
4
For agents it adds a measured run
An agent a maker submits is to be run against a fixed set of tasks in a sandbox, recording how many succeeded, the median time and the cost of one run. None has been run yet: the sandbox waits on isolated infrastructure, so these fields are blank on every listing today.
These are measurements, not claims. Where a listing has not been run, the field is blank rather than estimated. Independent testing of production agents in 2026 put the average success rate near 57 percent, which is why a measured number beats a marketing one.
A high success rate on our task set is not a promise about your tasks. Try it on your own work, somewhere of your own.

You have got it when

You can say, in one sentence, what the badge on a listing you are looking at does and does not tell you.

1
It applies to one version, not to the product
Verification runs against a single published version and records the hash of exactly what was tested. When the maker ships an update, the badge does not carry over. The listing drops to unverified until the new version has been through the same tests.
This matters more here than in most software categories. An MCP server describes its own tools to the model that calls it, so a maker who changes a tool description after you installed it has changed what the software does without changing anything you would notice.
A badge with an old date next to a recent update is the one combination that should stop you.
2
It covers the code, the dependencies and the declared behaviour
The verification panel on every listing page
The scan looks for credentials left in shipped files or in repository history, dependency versions with known published vulnerabilities, and whether the software does what its own manifest says it does.
That last check is the one people underestimate. A listing declares which tools it exposes, which scopes it needs and where it is allowed to send data. We compare the declaration against observed behaviour, and a mismatch fails the check even when neither half is dangerous on its own.
3
For MCP servers it adds the attacks specific to them
Any tool that accepts a URL is tested for whether it will fetch somewhere it should not. In a large independent scan of public MCP servers in 2026, more than a third of URL-accepting servers failed exactly that check.
Tool descriptions are tested for injected instructions, which is the attack behind the tool-poisoning vulnerabilities disclosed in 2025. Servers that expose command execution are tested for whether the command set is fixed or open ended.
4
For agents it adds a measured run
An agent a maker submits is to be run against a fixed set of tasks in a sandbox, recording how many succeeded, the median time and the cost of one run. None has been run yet: the sandbox waits on isolated infrastructure, so these fields are blank on every listing today.
These are measurements, not claims. Where a listing has not been run, the field is blank rather than estimated. Independent testing of production agents in 2026 put the average success rate near 57 percent, which is why a measured number beats a marketing one.
A high success rate on our task set is not a promise about your tasks. Try it on your own work, somewhere of your own.

You have got it when

You can say, in one sentence, what the badge on a listing you are looking at does and does not tell you.

What a Verified badge actually means

How What a Verified badge actually means works, in one picture

It applies to one version, not to the product

It covers the code, the dependencies and the declared behaviour

For MCP servers it adds the attacks specific to them

For agents it adds a measured run

Read next

What a Verified badge actually means

How What a Verified badge actually means works, in one picture

What a verification receipt actually says

It applies to one version, not to the product

It covers the code, the dependencies and the declared behaviour

For MCP servers it adds the attacks specific to them

For agents it adds a measured run

Read next

What a verification receipt actually says