How scores are calculated

One badge ladder

Per-scanner badges and the composite badge use the same thresholds, so there is a single rule to learn:

Per-scanner scores

A scanner's score starts at 100 and loses points for each finding, by severity. The result is clamped to 0–100.

• Critical cap: any critical finding forces the score to at most 59 — a scanner that finds a critical issue can never award Verified or Caution, no matter how clean the rest of the report is.
• Native scores:when the underlying tool ships its own 0–100 score (AgentShield does), we use the tool's number instead of the deduction table, then apply the critical cap on top. The scanner's scoresheet always shows which tool and version produced it.
• No findings = 100.A perfect score means that scanner found nothing — it does not mean the server is safe. That is why every scanner's report is shown side by side.

The composite score

The composite is a weighted mean over the components we could actually assess. Each scan phase's component score is the average of the scanners that completedin that phase; the weights below are renormalized to sum to 1.0 across only the phases that produced a result. A phase that has not been built yet, or that no scanner found applicable, is left out of the average entirely — it is never counted as a zero, so a clean partial scan is not dragged down by work we haven't done.

• Permission adjustment: when a server declares permissions beyond the baseline (read-only filesystem, outbound network, credential store), the weight of the corresponding risk category increases by 0.10 per extra permission — capped at 0.40 for any single component, with the increase redistributed from the others. The exact weights used for a scan are published with its results.
• Behavioral deductions: honeypot interactions observed during scanning subtract points directly from the weighted sum — 20 points per critical trigger, 5 per non-critical — before clamping to 0–100.
• Degraded assessments fail closed. If a scanner that was expected to run instead errored or timed out, the assessment is marked degraded and the composite badge is capped at Caution — it can never read Verified. A scanner that could not finish is treated as unknown risk, not zero risk.
• The composite is one view among many. It never overrides or hides a per-scanner verdict. Read the scoresheets.

Maintenance vitality

The vitality component measures whether a project is actively maintained, over the trailing 90 days. It is the mean of three sub-scores, each linearly interpolated and clamped to 0–100:

• Commit activity: 100 at ≥ 4 commits/month, 0 at none.
• Issue responsiveness: 100 when the mean response time is ≤ 48 hours, 0 beyond 30 days.
• Dependency freshness: 100 when dependencies are within 30 days of their patch releases, 0 when any is more than 180 days stale.

Where a signal simply doesn't exist (no issues ever filed, no dependencies), that sub-score gets full marks — absence of data is not treated as evidence of neglect.

“Your view” — the scanner filter

When you deselect scanners on a server page, the composite is recomputed from only the scanners you kept, each with equal weight (vitality joins as one additional equally-weighted term). Phase weights are deliberately dropped: the filter expresses “these are the tools I trust,” not “these are the phases I care about.” Behavioral deductions from honeypot evidence still apply — they are observed behavior, not a scanner's opinion, so they cannot be filtered out.

Check our work

Every scan stores its per-scanner reports, component scores, and the exact weights applied, immutably for 24 months. The scoring engine is a pure function: same inputs, same score. If you recompute a number from this page and get a different answer than we show, read our self-attestation for how to verify the scan pipeline itself, and tell us — publicly.