How UnofficialOS Verifies Software & MCP Servers
Our automated screening pipeline evaluates every repository across 5 distinct levels to ensure runtime isolation, manifest hygiene, and AI Agent safety.
Level 1: Repository Existence & Release Provenance
Authenticity, commit history, and active branch validation
Every tool listing must map to an active, publicly accessible Git repository with genuine commit provenance. We track repository age, release cadence, and author identity to ensure software listings are authentic.
Level 2: Package Manifest & Software License Compliance
Dependency tree auditing, typing definitions, and legal compliance
We inspect package.json, pyproject.toml, and wrangler.toml for permissive software licenses (MIT, Apache 2.0, BSD) and inspect dependency manifests against known vulnerability databases (NVD/CVE).
Level 3: Automated Static AST Security Screening
Heuristic code analysis for dangerous dynamic execution & credential leaks
Our automated static analysis scanner parses primary entrypoints (src/index.ts, main.py) to verify:
eval() or unsafe reflectionchild_process.exec)Level 4: Software Architecture & Integration Classification
Capability-aware classification: MCP Server vs Edge Worker vs SDK vs Native Binary
Software is classified into its authentic architectural archetype so developers receive precise, working configuration commands:
workerd); 1-click Cloudflare Worker deployment.npm install, pip, or cargo.Level 5: Verified Maintainer Attestation
Cryptographic / README badge verification and maintainer portal access
Authors can claim their project listing by embedding the verified shields badge in their GitHub README or undergoing manual review. Approved maintainers gain the ability to trigger fresh live security scans and update documentation.