How we score
Each tool is rated on seven controls. We only use public docs, official repos and vendor security pages. No vendor reviews or pays for a rating.
The seven criteria
- Permission granularity. Can you allow or deny specific commands, tools, paths or MCP servers, not just "on" or "off"?
- Human approval gates. Can risky actions pause for a person, and is that the default?
- Sandboxing. Is execution isolated by the OS, a container or a VM, and what falls outside it?
- Secrets handling. Are credentials scoped, encrypted, or kept away from the agent?
- Audit logs. Can you see afterwards what the agent did? Git history and checkpoints count for partial credit.
- Kill switch / interrupt. Is there a documented way to stop or pause a run mid-flight?
- Network egress control. Can you restrict where the agent's commands can connect?
Scale
| 0/3 | Docs say it is absent, or tell you to provide it yourself. |
|---|---|
| 1/3 | Exists, but coarse or easy to bypass. |
| 2/3 | Solid and configurable, with known gaps. |
| 3/3 | Granular, enforceable, and admin-lockable. |
| Unverified | We could not confirm it in public docs. Not counted either way. |
Overall grade
All seven controls carry equal weight. The grade starts from the plain average of the verified controls: A at 2.5 or above, B at 2.0, C at 1.5, D at 1.0, F below that.
Then coverage caps it. An A needs at least 5 of 7 controls verified, a B at least 4, and a C, D or F at least 3. A tool with a high average but thin coverage drops to the best grade its coverage allows. With fewer than 3 verified, the grade is Unverified. Every card and tool page shows how many controls we verified, as "N/7 verified".
"Top safest this week" lists the highest graded tools, ties broken by how many controls we verified, then by average, then alphabetically by name.
Sources
Every note on a scorecard is backed by a page in that tool's source list. If we can't point to a source, the claim is cut or the cell says Unverified.
Freshness
Every tool shows a last-checked date and the exact pages we read. Last full review: 2026-10-16. Tools ship fast. If a doc changed, tell us. We review corrections within 7 days.
What this is not
This is not a security audit or pen test. It describes what the docs say you can configure, not how well it holds up in practice. Ratings are editorial.