The short answer: your report carries two results, not one score — a verdict on reachability (EXPOSED, REACHABLE, COVERED, or UNKNOWN, read from the actual response your endpoint gives the internet) and a tool-surface grade (None seen, Low, Medium, High) for the abilities the server shows. HomeShield deliberately does not roll these into a single number: a COVERED server with a High tool surface and an EXPOSED server with none seen are different problems needing different fixes, and one blended score would hide which one you have. This page reads each result plainly. Verdicts as classified by HomeShield's prober, November 2026.
| Verdict | What the probe saw | Your next move |
|---|---|---|
| EXPOSED | HTTP 200, and the response spoke MCP (protocol markers or an SSE stream) to an unauthenticated internet request | Today: authenticate the server or close the public path. Then shrink the tool surface and re-check. |
| COVERED | An authentication response — 401, 403, or 407 | The correct posture. Keep it, minimise the tool surface anyway, and re-check after changes. |
| REACHABLE | HTTP 200 without MCP markers — something answered, but it did not identify as an MCP server | Identify what answered (a web UI answers 200 too). If it fronts your server, give it the same authentication question. |
| UNKNOWN | 404, a server error, or a response the probe cannot interpret as an MCP exposure signal | The probe says which. Check the exact URL — it also tries the common MCP paths and http/https variants — and re-run. |
Separately, the probe enumerates the tools the server exposes and grades the surface by capability: None seen (no tools visible from outside), Low, Medium, or High. Tools that read are safer than tools that write; tools that execute commands or reach other machines are the heavy end. Read the two results together: verdict × surface is your actual risk. EXPOSED × anything is the emergency. COVERED × High means your safety is exactly one credential thick — worth the checklist pass that shrinks the surface behind the login.
Three honest limits, printed here because they are printed on the reports too. One endpoint: the probe reads the public URL you declared (plus the common MCP paths on that host) — other services on other ports are other checks. From outside: it cannot see your LAN, your router, or anything behind the firewall; the local-scan guide and its companion script cover the inside. At a moment: exposure drifts with every router change, tunnel, and update — a verdict is a dated reading, which is why the checklist ends with a re-probe rhythm. When the counters are quiet — no tools seen, no public path found — the report says exactly that and nothing more. Quiet is a result, not a gap in the data.
Four: EXPOSED (the endpoint answered 200 and spoke MCP to an unauthenticated request), REACHABLE (200 but no MCP markers — something is there), COVERED (an authentication response: 401, 403, or 407), and UNKNOWN (no usable signal — 404, a server error, or an answer the probe cannot interpret as an MCP exposure signal).
No. REACHABLE means a service answered on that URL without identifying as MCP. It might be a web UI, a different app, or an MCP server on a path the probe did not guess. It is a 'look closer', not a clean bill.
Separately from the verdict, the probe grades the tools the server shows: None seen, Low, Medium, or High, grouped by capability. A COVERED server with a High tool surface is one stolen credential away from a bad week; an EXPOSED server with any tool surface is the emergency.
UNKNOWN is the probe being honest: the response gave no interpretable MCP signal — the path may be wrong, the server may be down, or it may answer only on a different variant. Check the exact URL (the probe also tries the common MCP paths and the http/https variants) and re-run.
No, and the report says so. The probe reads one declared public endpoint from outside. It cannot see your LAN, your router, or services that never face the internet — the local-scan guide and its companion script cover the inside of the house.
HomeShield MCP uses cookies to run the site and, through Google AdSense, to serve ads. Accept or decline non-essential cookies. Details are in the privacy policy.