# Proof You Can Hand a Stranger

The first time the discipline in this book pointed at software I had not written, the software belonged to a company with a legal department, and it graded badly enough that I did not dare publish the grade.

Not software I had bought. A Model Context Protocol server, shipped under a recognizable vendor's name, that I pulled into a sandbox, launched, enumerated, and scored exactly the way I had spent a year scoring my own tools. The registry it went into is called mcp-trust, it is live and public at mcp-trust.vercel.app, and it grades MCP servers on a danger scale from A to F: a Socket.dev or OSV.dev for a supply chain nobody was watching yet. It does not care whose name is on the box. It reads the tool surface, applies the rubric, and returns a letter. Servers from Microsoft, from Google, from NVIDIA and SAP sit in that corpus of thirty-one alongside the toys and the weekend projects. And the moment one of those recognizable servers came back with a failing surface, the discipline changed shape, because a grade you assign to your own benchmark is a private conclusion whose worst crime is fooling you, while a grade you publish about a named company's software is a claim, pointed at a party that can fight back, that any stranger can pick up and try to destroy.

Everything in this book until now has been verification turned inward: the operator refusing to take his own controls at their word. This chapter is the day the target became someone else and the audience turned hostile, because that is the day verification stops being private hygiene and has to become something portable, a proof you can hand to a stranger who wants it to be false and watch it hold anyway.

## The letter is the easy part

Producing the grade was the tractable engineering problem, and tractable problems are seductive because finishing them feels like finishing the work.

The scanner, mcpaudit, launches a server inside a network-off Docker sandbox, enumerates the tools it actually exposes over the protocol, and scores the capability surface: what it can read, what it can write, what it can execute, and how honestly it admits to any of it. That machinery is real and it works. But a grade is cheap to compute and expensive to publish, and the distance between those two costs is the whole subject of this chapter. The instant a failing letter about a named vendor's server goes on a public URL, three questions arrive that no scanner answers. Can you prove it. Can the graded party argue with it. And when it is wrong, or goes stale, or the vendor ships a fix tomorrow morning, what happens to the letter you already published. A scanner that cannot answer those is not a registry. It is an accusation with good production values.

## The receipt

So the first thing every grade carries is not its letter but its receipt, and the receipt is built to be handed to the exact party the grade indicts.

Each scan records which image ran it, so the environment is not a rumor. It records that the sandbox saw nothing on the network, because a grade produced with live network access is measuring the internet, not the server. And for a server that refuses to start without credentials, the receipt records the names of the environment variables the scan supplied and never their values, because the values were non-functional all-zeros dummy tokens, injected for the single purpose of getting a token-gated server past its own front door and into tool enumeration, persisted nowhere, and refused outright the instant a source is remote or the network is on. That design exists so the graded vendor can read the receipt, see precisely what was and was not done to their software, rebuild the image, and run the scan themselves. A finding you cannot reproduce is an opinion. A finding the accused can reproduce is a fact you merely noticed first.

## The floor the site cannot fall through

The receipt makes a grade defensible. The next problem is the grade you do not have.

A registry with thirty-one entries and a promise of more lives or dies on what it does when it has not scanned something yet, because the tempting move, the one that makes the site look complete, is to fill the gap with a plausible letter. mcp-trust is built so it structurally cannot. An unscanned server renders the word "unscanned," never a letter. Demo grades are opt-in, and when they are on, the page wears a banner that says so in the plainest words available. A verify floor sits underneath the whole site with one job: refuse to display any grade that did not come from a real scan. This is the book's oldest law aimed at my own storefront. The label is not allowed to diverge from the effect. A site that will invent a B to avoid an awkward blank is a site that will eventually invent an A, and the first reader who catches the invented B stops believing the earned ones.

## The mask

And then the part that reads, at first, like a betrayal of everything argued so far. Some failing grades on named vendors are deliberately hidden.

Eight of them, at the time of writing, render "under review." No letter. Findings withheld. The scan ran, the server graded badly, and the public page shows a stranger none of it. If you have followed the argument this far, that should land as censorship of a true finding, which is precisely the sin this book keeps convicting other systems of. So let me be exact about why it is the opposite.

Masking is not the suppression of a result. It is the honest admission that two things I had been treating as one are separate states of readiness. "I scanned this vendor's server and it failed" is one state. "I am ready to publish a failing grade on a named company, with a dispute path, a methodology a lawyer can read, and outside counsel who has weighed the exposure" is a different state, and I had reached the first without the second. Publishing the letter in that gap is the same species of error the previous chapter just finished confessing. There, a true measurement wore a headline it could not support. Here, a true scan would wear a public claim I could not yet back. Both take the identical remedy: withhold the headline, keep the receipt, and say out loud exactly what is and is not ready. Un-masking is gated, per entry, on two locks that must open together, the technical residual closed and counsel clear, and until they do the honest surface is three words instead of a letter I would have to retract in front of a legal team.

## Building the adversary's rights into the artifact

The mask is a holding state. What it holds for is a set of rights I had to build, deliberately, into a thing whose job is to grade people.

There is a methodology page, because a grade whose ruler you cannot inspect is an opinion in a lab coat, and the fastest way to lose a stranger is to hand them a letter and hide the rubric behind it. There is a dispute path with a fourteen-day commitment, because a graded party who cannot answer back is being convicted without a hearing, and a registry that convicts without a hearing has earned exactly the credibility it would extend to anyone else who did the same. There is a corrections page, standing evidence that the grades move when they are wrong. There is a provenance card on every entry, so a reader can see where a grade came from before deciding how far to trust it. And there is a staleness rule that demotes any grade not re-verified within ninety days, on a schedule, without me, because a claim about live software is perishable and the final chapter is about to insist that a closure is worth exactly its most recent re-verification and not a day longer. Each of these is a lever I built and then handed to the person most motivated to move my grade against me, which is the only sort of accountability a stranger has any reason to believe.

## The grader submits to the rubric

One more turn, the one the previous chapter would demand. The tool that grades MCP servers ships as an MCP server. It is public on PyPI as mcp-trust, it exposes its own tools over the same protocol it audits, and that makes it a legitimate subject for its own rubric. The auditor of the last chapter audited its own benchmark; this one consents, in public, to be measured by the exact instrument it points at everyone else. That is not a stunt. It is the entry fee for grading strangers: a fair rubric survives being turned around, and a rubric that cannot survive being turned around is one the strangers were right to distrust.

## Proof you can hand a stranger

Here is the chapter compressed to the sentence it stands on. When you verify your own work, the enemy is self-deception and the receipts are for you. When you publish a verified claim about someone else's work, the enemy changes and the receipts change with it. The enemy is now a reader with every incentive to prove you wrong, a vendor with counsel on retainer, a stranger who opens the page already certain you are grinding an axe. The receipt is no longer a private note that keeps you honest in the dark. It has to be a portable object that keeps holding after it leaves your hands and lands in the grip of the one person who wants it to shatter.

Every mechanism in this chapter is that single move performed on a different part. The scan receipt makes the finding reproducible by the accused. The verify floor makes the site incapable of showing a grade it did not earn. The mask makes the difference between having a finding and being ready to defend it visible instead of papered over. The dispute clock, the methodology page, the corrections log, and the staleness rule each hand the graded stranger a way to push back that actually moves the result. Verification capital, the asset this entire book has been assembling, stays private and unspendable for as long as the proof lives only in your head and your good intentions. It turns into a public asset at the exact moment you can hand the proof to the person who most wants it to be false, and it holds.

Which is the last thing this book has to build before it can end. The final chapter asks what an operator owes the controls he can no longer fully see, and the answer arrives at the same shape one size larger: the loop, the receipts, and the willingness to hand both to the next operator with nothing hidden and the evidence still attached.