How we rank AI tools (and why rankings can't be bought)

How Catervas lists, checks and ranks AI tools: trust checks, license and security audits, Fit Score weights, and why no vendor can pay for a better spot.

Published Nov 8, 2026 · 7 min read · By Catervas team

Tags: catervas, rankings, trust

Every tool in the Catervas library gets the same checks and is ranked by the same math. No vendor can pay to move up or to get listed. Here is how it works, taken from our How we rank & verify page, so you can judge our picks yourself.

Last checked: November 2026.

What gets a tool listed

Our first round of research found the paid and free tools in the library. Today it holds 99 tools: 71 paid and 28 free open-source (Catervas API). Tools are matched to the problems owners face in 10 Maryland industries. We ranked those industries by how many small businesses Maryland has, using U.S. Census County Business Patterns (2023) and Nonemployer Statistics (2022), then researched the top 5 problems in each (How we rank).

A discovery agent also looks for new tools. But nothing goes live until a person on our team approves it, including tools the agent finds on its own (How we rank).

No tool pays to be listed or to rank higher. A tool's place comes only from the math below (How we rank).

Trust checks

Every listing carries a Trust badge. It is separate from the ranking score. Our discovery agent re-runs the checks every week, and our team confirms them (How we rank).

Check	Paid tools	Free open-source tools
Admin-verified listing	Our team reviewed the listing	Our team reviewed the listing
License verified	Doesn't apply	The license is on our approved list
Active maintenance	Product page or changelog updated in the last 6 months	A release or code change in the last 6 months
No open critical security advisories	No known breach or critical security flaw	No open critical GitHub security advisory or CVE
Privacy and data policy	Has a privacy policy and notes where data is stored	Your data stays on your own hosting
Company or foundation backing	The company is named	A company, foundation or active team is named

The badge has three states:

Verified: our team checked the listing and every check that applies passed.
Caution: listed, but at least one check failed. The badge says which one.
Not verified yet: our research agent found the tool and took its details from public web pages, but we haven't checked it ourselves yet. It carries a "Use with caution" note until we do.

A Caution tool still ranks normally, but it shows the warning, and the "Verified only" filter hides it (How we rank). Right now, 83 tools are Verified, 6 show Caution and 10 are not verified yet (Catervas API). For example, the free booking tool Easy!Appointments shows Caution because of known security problems in its current release.

License checks for free tools

"Free · Open source" on Catervas means the license lets a business use the software to make money. You pay nothing for the software, though you may pay for hosting, and we include hosting in the cost (How we rank).

Permissive licenses such as MIT, Apache-2.0 and BSD let you use it, change it and sell with it.
Copyleft licenses (GPL-2.0, GPL-3.0, AGPL-3.0) are also free for business use. These tools show a note: if you change the code and share it, or run a changed version as a public website, you must share your changes.
Not listed as free: source-available licenses (Business Source License, Elastic License, SSPL), the Sustainable Use License, Commons Clause, non-commercial Creative Commons, and code with no license at all.
Mixed or custom licenses must be read by an admin before listing. Open-core tools are listed for their free part with a note that some features need a paid edition.

License summaries are information, not legal advice.

Security audits for free tools

We audit free open-source tools one release at a time (How we rank):

The code. We run Cloudflare's open-source security-audit skill on the release. An AI agent looks for weak spots, then a second pass tries to disprove each one.
The packages it uses. osv-scanner checks third-party packages against public lists of known vulnerabilities.
Known advisories. We count only the project's GitHub security advisories that affect the audited version.

To pass, a release needs no confirmed high or critical issues, no unresolved high or critical leads, no known critical package vulnerabilities, no GitHub advisory affecting that release, and a finished report that passes the skill's own format checks. A passing tool gets a "Security audited" badge naming the exact version and commit. When a newer release comes out, the badge says the new one isn't audited yet.

We never publish the details of a finding. We share them privately with the project's maintainers first so they can fix them, and tool pages show only counts. An audit lowers risk, but it can't prove software is safe. Cloudflare doesn't audit or endorse these tools. We run their open-source skill ourselves.

The Fit Score

When you use Find my tools, each tool gets a Fit Score from 0 to 100 for each problem you picked (How we rank):

Part	Weight	How it's scored
Problem match	35%	Built mainly for this problem 1.0, also helps 0.6. Below 0.3 isn't considered
Works with your tools	20%	Share of your current tools (like QuickBooks or Square) it connects to. Neutral 0.7 if none apply
Cost	20%	True monthly cost at your size against a typical budget. Quote-only pricing scores 0.4
Setup	15%	Paid: easy 1.0, medium 0.6, hard 0.3. Free: one-click hosted 0.6, needs a tech helper 0.3
AI features	10%	Generally available 1.0, beta 0.6, waitlist 0.3, no AI 0.2

For cost, the budget band depends on team size: $60/mo per tool if it's just you, $200/mo for 2 to 9 people, and $600/mo for 10 to 49. A tool gets full points at half the band or less, falling to zero at twice the band. For free tools, we count hosting: the one-click host's price, or $10/mo for a small server if there isn't one.

If you tell us you'd want help, a free tool that needs a tech helper scores 0.5 for setup instead of 0.3, because we can set it up for you.

Ties go to the better problem match, then the lower cost, then A to Z.

Once a tool has 5 or more real reviews from signed-in owners, the score you see becomes 70% Fit Score and 30% community score. Sample reviews and hidden reviews never count (How we rank).

The library order

When you browse the Tools library and pick a kind of business, tools built for that business come first, then general tools that help with at least one of its problems. Our team decides which tools are built for each kind of business. Inside each group, the order adds up four things (How we rank):

45%: how many of the industry's top problems it helps with (bigger problems count more)
25%: how strong its best match is
20%: how focused it is on this kind of business
10%: its Trust badge

If you also pick a problem, how well the tool solves that problem counts for 50%. With nothing picked, Verified tools come first, then A to Z.

How we make money

The library is free. Browsing, Find my tools, comparing and saving tools cost nothing, and you never need a credit card (Help).

What we offer is help setting tools up. It starts with a free 30-minute video call to learn how your business works and look at your plan. Then we help you pick the right tool, set it up, and connect it to tools you already use, like QuickBooks or Google Calendar. For free open-source tools, we can also set up the hosting. We agree on what's included before any work starts (Help).

Some "Visit tool" links may be affiliate links, which means we may earn a referral fee. If so, the tool page says so, and it never changes a score (Help). As of this week, none of the 99 listings in our API is marked as an affiliate link (Catervas API).

What we don't do

We don't sell rankings or listings.
We don't let AI rank tools. The ranking is plain math. AI only writes the short "why this fits" text, using facts we've stored.
We don't call source-available software "free."
We don't give professional or legal advice. Listing a tool is not an endorsement or partnership.

Prices and features change. Each price shows its source and the date we checked it (November 5, 2026, for the current library), so check with the vendor before you buy (How we rank).

Need a hand?

If you want a second pair of eyes on a tool or help getting one running, book a free call with Catervas. For free, independent advice, the Maryland SBDC has Technology and AI advisors who help at no cost (Help).