How we score
Each tool is rated on seven controls. We only use public docs, official repos and vendor security pages. No vendor reviews or pays for a rating.
The seven criteria
- Permission granularity. Can you allow or deny specific commands, tools, paths or MCP servers, not just "on" or "off"?
- Human approval gates. Can risky actions pause for a person, and is that the default?
- Sandboxing. Is execution isolated by the OS, a container or a VM, and what falls outside it?
- Secrets handling. Are credentials scoped, encrypted, or kept away from the agent?
- Audit logs. Can you see afterwards what the agent did? Git history and checkpoints count for partial credit.
- Kill switch / interrupt. Is there a documented way to stop or pause a run mid-flight?
- Network egress control. Can you restrict where the agent's commands can connect?
Scale
| 0/3 | Docs say it is absent, or tell you to provide it yourself. |
|---|---|
| 1/3 | Exists, but coarse or easy to bypass. |
| 2/3 | Solid and configurable, with known gaps. |
| 3/3 | Granular, enforceable, and admin-lockable. |
| Unverified | We could not confirm it in public docs. Not counted either way. |
Overall grade
The grade is the average of verified criteria only: A at 2.5 or above, B at 2.0, C at 1.5, D at 1.0, F below that. If fewer than 3 criteria are verified, the grade is Unverified. We would rather show a gap than guess.
"Top safest this week" lists the highest graded tools, ties broken by average and then by how many criteria we verified.
Freshness
Every tool shows a last-checked date and the exact pages we read. Tools ship fast. If a doc changed, tell us.
What this is not
This is not a security audit or pen test. It describes what the docs say you can configure, not how well it holds up in practice. Ratings are editorial.