The top tier is earned, and the gate is public.
Most directories give you an opaque number and ask you to trust it. Certified is the opposite: a conjunctive gate — every check below must pass, no averaging, no cheating — published in full, so you can see exactly why a tool does or doesn't earn it.
What it takes — all six, or it's not Certified
artifact_scannedThe published artifact was scanned — not just the source repo.
provenance_verifiedBuild provenance is cryptographically verified (npm Sigstore / PyPI PEP 740) and binds to the source repo.
no_driftNo unexpected files, modifications, or install hooks added since the last signed scan.
no_critical_or_highZero critical or high findings — and nothing known-malicious.
recompute_readyThe verdict is offline-recomputable — full coverage metadata is recorded.
full_coverageThe entire tree was scanned, not sampled.
Plus the answer: the mark shows only beside Safe to connect, at a trust score of 81 or above, once the sandbox result is in and with enough code to inspect (8 or more files). A tool that passes the six checks but reads Review keeps a "Certified checks pass" note on its page, not the mark. The score and trust tier are never gated, only the Certified mark is.
Hard disqualifiers
Publishing the gate is only half of it — here's what fails a tool outright, so no one has to guess.
A single unresolved critical floors the score to 45 or below — Certified is off the table until it’s fixed.
A dependency flagged malicious (MAL) forces the score to 20 or below. No exceptions.
The most common reason a good tool isn’t Certified: it publishes no cryptographic build attestation, so we can’t prove the artifact came from the source you claim.
If we couldn’t scan the whole tree, we won’t certify what we didn’t see.
A deprecation, an advisory against this version, a high finding or a sandbox catch makes the answer Review, and the mark comes off until it reads Safe again. So does a score under 81, a sandbox run still in progress, or too little code to inspect.