awslabs/mcp (opens in a new tab)
Strong
Strong on every check. No grade is a guarantee, so only install what you need.
Open source MCP Servers for AWS
What should I do?
It's widely used, looked after, open about itself, and shows none of the malware tricks we check for. Download it only from its official GitHub page, never from a copy, a file-sharing site or a link in a video.
Warning signs 0
None found
We didn't find any of the common malware tricks.
Talks to your AI 0
We found no files that give instructions to AI coding tools.
Does it cost money?
Its page mentions “pricing”, “free tier”. The code here may be free, but some features or the service it connects to may cost money. Check their pricing page before you rely on it.
Why this grade?
It scored 95 out of 100. 85 or more is an A. Each area gets its own letter, and the overall grade can be at most one letter better than the weakest safety area ("Is it open about itself?" only costs points). Open a row to see what we checked.
Area grade ADo people trust it?, 30 out of 30 points
Good: Stars. 9,821 people starred it.
Stars are like bookmarks. Malware repos rarely have many real users, and lots of stars means lots of people have looked at it. Stars can be bought, so we also check how fast they came.
Good: Forks. 1,827 copies made by other developers.
A fork is a copy another developer made to build on. Real projects get copied; fake ones rarely do.
Good: Owner history. Organization created 13.8 years ago.
Scammers use brand-new accounts that get banned and replaced. An owner who has been around for years has more to lose.
Area grade AIs anyone looking after it?, 25 out of 25 points
Good: Recent updates. Last change 0 days ago.
Software nobody updates stops getting security fixes.
Good: Track record. Repo is 1.6 years old.
Older projects have had more time for problems to be spotted and reported.
Good: Releases. Publishes versioned releases.
A release is an official, finished version. Without one, you download whatever is in the code that day.
Area grade BIs it open about itself?, 12 out of 15 points
Good: License. Uses the Apache-2.0 license.
A license says whether you're allowed to use it. Serious projects almost always have one.
Good: Instructions. Has a README that explains the project.
A README explains what the project does and how to use it. Malware often has a thin or copied one.
So-so: Security contact. No security policy file.
A security policy tells people how to report problems privately, so they get fixed before attackers use them.
Area grade BDoes it have good security habits?, 7 out of 10 points
Good: Code review. Almost every change is checked by a second person before it goes in.
When a second person checks every change before it goes in, it's much harder to sneak in something bad. From OpenSSF Scorecard, an independent security check.
Poor: Known security holes. About 10 known security holes still unfixed (10 or more).
Security holes that are public but not fixed yet are what attackers look for first. From OpenSSF Scorecard.
Good: Safe automation. Its build-and-publish robots are set up safely.
Most projects use robots that build and publish the software. Robots with loose permissions have been used to slip malware into real, popular projects. From OpenSSF Scorecard.
Area grade AAny malware tricks?, 30 out of 30 points
Good: No warning signs found. We didn't find any of the common malware tricks.
We look for tricks that keep showing up in malware: requests to turn off antivirus, locked zip files, cracks and free premium, hidden code, and AI instruction files that try to take over your assistant. Serious ones cap the grade, however popular the repo is.
Checked Oct 23, 2026. We re-check this repo every night. A grade is a set of warning signs, not a guarantee. How we score