A subagent needs a tool it does not have.

23 real servers, graded

Configuration cannot tell you which one is hostile

Every row is an audit that ran against a live public endpoint on 3 September 2026, and every row links its full transcript. Read the configuration column before the grade. The server that fails scores 89.86% there, higher than seventeen of the servers that pass.

Nineteen A, two B, one C, one F. Every one is a partial audit: the four model-driven probes need an API key that has not been supplied, so half the grade is unmeasured, the weights renormalise over what ran, and each report says so in its provenance section. The injection scan needs no model, which is why the F is real.

The system this was built for

Twenty-seven agents. One of them holds MCP tools.

This is Clembot, a real multi-client marketing system, read straight from its own .claude/agents directory rather than drawn for a slide. Twenty-seven subagents and six skills. Exactly one agent holds MCP tools today: Design Director, with fifteen of them, none of which have ever been graded. That is the gap the doorman exists to close, and it is the reason it was built here first.

A tool handed to all twenty-seven costs all twenty-seven: every subagent carries descriptions it will mostly never call, plus that many more chances to pick the wrong one. So the doorman does not install anything globally.

Do not take our word for it

Check every grade on this page yourself

“Replay the tape” is a slogan until someone can actually run it. This is the thing that runs it. One file, no dependencies, Node 18 or newer. It does not call our grader: it talks to the graded server directly, then checks our published claims against what it found.

# from the repo node mcp-scorecard/verify-tape.mjs https://webzum.com/api/mcp

• Fetches the server itself. Speaks MCP to the graded endpoint and reads its tools. We are not in this step.
• Compares it to our tape. If we trimmed, altered or invented a tool description, this disagrees.
• Re-runs the patterns from a copy inside that one file, over text it fetched from the server, not from us.
• Checks the grade follows its own rules. A hard hit must cap at F. Steering must not.

It reports a changed description as drift, not as fraud, because a server is allowed to change and only its operator knows which happened. The audit timestamp is printed so you can judge. A real disagreement is a bug report against us, and we would like to receive it.

Pointing an agent at this is the same job: give it the transcript url and the four checks above. The transcript is newline-delimited JSON, public, unauthenticated, and never truncated or sampled. Everything a grade asserts is in it.

Why it is scoped, not shared

A tool given to every agent costs every agent

Tool definitions are context. Load a twelve-tool server into every subagent and each one carries twelve descriptions it will mostly never call, plus twelve more chances to pick the wrong one. Logical grouping is not tidiness. It is the thing that keeps a subagent both cheap and correct.

Paid, per grade

Agentified through Bazantic

Grading a server costs real model tokens, so the scorecard is a paid API rather than a free one. Bazantic is the layer that makes it callable by an agent and payable per call, which is what lets the doorman buy exactly one grade with no subscription, no account, and no human in the loop.

What happens if you skip all of that

A gate that fails closed

Until a server has been graded and scoped, no subagent reaches it. The hook runs before every MCP tool call, reads a local file, and blocks anything it cannot vouch for.

> research-agent: summarise what acme-helper knows about this repo

· calling mcp__acme_helper__search
BLOCKED by doorman

  doorman: 'acme_helper' is UNKNOWN. Blocking until it has been graded.

  An ungraded MCP server is not a trusted one. Nothing about
  'mcp__acme_helper__search' has been verified: not its tool
  descriptions, not its error handling, not whether its descriptions
  contain instructions aimed at you.

  To grade it:   /vet <server-url>

No network

The gate contains no network command at all. A gate that asks a server for permission is offline the moment the network is, and offline would have to mean allow.

No dependencies

Bash builtins and coreutils only. No jq, no node, no python. A gate that fails to start is a gate that fails open.

Fails closed

Unparseable input, missing registry, unknown server, unreadable file: all block. The default answer is no.

Exit 2, never exit 1

Only exit 2 blocks a tool call. Exit 1 is treated as a script error and the call proceeds. Every refusal path exits 2, and a test asserts the file contains no exit 1.

Humans own the list

Nothing writes to the allowlist automatically. The poller reports what changed and refuses to allowlist a hard fail even when the service says allow.