Method, and what it cannot establish
Given a package name and nothing else, a Level 1 measurement does five things and stops.
1. Installs the package into an empty directory, watched by the kernel. 2. Starts it in a sandbox with no route off the machine, where every hostname answers to the loopback address and every credential is fake. 3. Records what it did before any tool was used: names it looked up, encrypted connections it opened, programs it started, files it wrote. 4. Asks once for its list of tools. No tool is called. 5. Reads the README that shipped in the package and compares.
The standard
A website counts as declared only if the README names it. A tool counts as documented only if the README names it as a whole word. Matching is exact, so a subdomain is not its parent: a README that links to example.com has not named api.example.com.
The host pattern is loose in one direction and it is better to say so: it reads any dotted name whose last part is two or more letters, so a filename written in prose can read as a website. That can only make the declared list longer and leave something out of the findings. It cannot put something in.
Not calibration-backed
BRYDGE's ten curated measurements are backed by a calibration: two servers that lie on purpose, which the harness must catch before any result may be published. That calibration proves the instrument catches planted claims about what a tool did. Level 1 calls no tool and reads each README by a stated rule rather than by a person, so nothing in that calibration speaks to these pages. Every Level 1 page says so.
Not a ranking
The set measured is whatever two registry searches returned, read by hand for whether each package is a server that starts without a credential. Download figures decided nothing about the order of the table, which is alphabetical by package. Nothing here says one server is more used, better or worse than another.
Findings are sent to maintainers first
A page that reports a finding is not published until that package's maintainers have been notified and three days have passed. The notice carries the same evidence lines as the page, states the standard in full so a maintainer can say it is the wrong standard, and names the two answers that would both be fair: documented elsewhere, or a documentation gap. A page cleared for publication is listed by hand in site/cleared.txt, so the clearing is in the repository's history.
What a page does not say
- It judges no tool. None was called.
- It is one run, once. A program that behaves one way while watched and another way otherwise would produce the same page.
- It ran with no route off the machine, so anything that only happens after a connection succeeds did not happen.
- Encrypted traffic was not read. The name asked for is recorded; the contents are not, and would not be even with a route.
- "Declared" means named in the README, nothing more.
- The harness is BRYDGE's own, and BRYDGE has an interest in the question of whether tools do what they say.
Run it yourself
The harness, the two lying servers it is calibrated against, every evidence file behind these pages and the code that renders them are public: https://github.com/contactkontey-dotcom/brydge-mcp-measurements. Instrument fingerprint ca9170dfaeae.