Scoring methodology

Three-layer architecture

The scoring system operates in three layers. Each layer is grounded in a different established framework, and each answers a distinct question.

Layer 1: Finding severity

Findings are classified into two categories based on what they represent. This distinction is grounded in NIST SP 800-30’s concept of compounding risk factors: correlated failures are worse than the sum of their parts.

CVSS-derived severity ratios

The deduction ratios are not invented. They are derived from CVSS v4.0’s expert-calibrated severity scale using the midpoint of each qualitative range, normalized to Critical = 1.0. This ensures that the relative impact of a High finding versus a Medium finding reflects the consensus of the security research community, not an arbitrary choice.

Adversarial finding classification

Adversarial test findings use an impact-based classification system that determines how each finding affects the trust score. The golden rule is impact over intent — classification is based on what the finding demonstrates, not what the attacker intended.

Layer 2: Signal aggregation

The trust score is computed from eight signals organized into three categories. Category weights are derived from documented pairwise comparisons following the CVSS v4.0 calibration methodology.

Category weights

Safety is a prerequisite for utility, and verifiability prevents safety theater. The ordering Safety > Verifiability > Utility follows from three pairwise comparisons:

Signal structure

Eight signals contribute to the trust score. Within each category, weights reflect the fidelity and directness of the evidence each signal provides. Safety carries the most weight overall, with adversarial testing valued highest within it because active exploitation is the highest-fidelity proof of danger.

Utility confidence multiplier

Utility functions as both a direct score contributor and a confidence multiplier. If a capability doesn’t work, confidence in its safety and verifiability assessments is diminished — an unreliable capability may not have been adequately exercised during testing. This is grounded in NIST SP 800-30’s principle that risk factors compound.

The multiplier floor is tiered based on the safety profile. A capability with a clean safety profile but no functional evidence receives a milder drag than one with active safety findings. This prevents safe-but-untestable capabilities from scoring identically to actively dangerous ones.

Layer 3: Grade boundaries

Grade boundaries are derived from representative finding profiles, not chosen arbitrarily. Each profile describes a typical capability at that grade level, and the estimated score range is produced by running the profile through the Layer 1 + Layer 2 model.

Key structural properties

Safety’s dominant weight means a total safety failure makes a passing grade mathematically impossible. A single critical finding — combined with real-world noise from other signals — makes it very difficult to stay above the D threshold. A critical finding should be near-incompatible with a passing grade.

The D range (65–71) is deliberately narrow. A capability in this band is either clearly passing or one finding away from failure. This communicates urgency without false condemnation.

Certification tiers

The trust score and the certification tier are independent assessments. The score is a numeric summary of overall trustworthiness. The tier is a pass/fail judgment based on finding-severity thresholds, modeled on UL (Underwriters Laboratories) product certification per ISO/IEC 17065.

A capability can have a high trust score and a Verified (not Certified) tier if it has clean signals everywhere except one critical adversarial finding. The score says “mostly trustworthy.” The tier says “didn’t pass the safety gate.” Both are correct.

OWASP MCP Top 10 coverage

The OWASP MCP Top 10 is the emerging industry vocabulary for MCP security risk. Fidensa’s pipeline stages map to it as follows. This is not the totality of what Fidensa evaluates — behavioral fingerprinting, functional correctness, and provenance verification go beyond the OWASP scope.

Maturity indicator

The maturity indicator is an orthogonal dimension that communicates how much real-world validation backs the trust score. A score of 91/A/Initial means excellent pipeline results with no field data yet. A score of 85/B/Proven means good results confirmed by hundreds of consumers over six months.

Risk tags

Risk tags are additive metadata included in every certification contract. They have zero score impact but enable granular policy enforcement. A consumer policy engine might allow Grade D capabilities but block any tagged ADV, or require manual review for SC tags.

Calibration plan

All weights, deduction amounts, and grade boundaries are provisional. They are derived from established frameworks and documented reasoning, but they have not been empirically calibrated against a large body of certification data. Every published contract references the methodology version under which it was scored.

Framework citations