The problem: when you install an MCP tool, you're giving an AI agent code execution on your machine. I scanned 88K+ tools and found crypto miners, SSH backdoors, prompt injection, and tools silently reading .env files and SSH keys. 537 flagged total.

How it works: - Static analysis + AI security review generates a trust score (0-100) per tool - Verified tools earn badges (install, boot, tool discovery all tested) - Everything is searchable with security-aware ranking

Ways to use it: - Browse: https://getvet.ai/catalog - CLI: `npx @getvetai/cli find "database"` - MCP server (yes, an MCP that discovers MCPs): `npx @getvetai/mcp` - API: `curl https://getvet.ai/api/v1/discover?q=github`

The CLI is open source: https://github.com/getvetai/cli

Free to use. If you build MCP servers, you can claim and get verified.

Would love feedback on the security analysis approach and what data you'd want to see.