MCP security report: what 22,148 servers and 16,500 agent skills look like under automated checks
We run the same checks on every MCP server and agent skill we list, and this page counts the results. It updates every day from the latest report of each listing. The numbers are free to reuse with a link.
Server checks
Passed, out of servers where the check appliedScore distribution
5,676 servers (25.6%) score 100. 12,960 sit between 50 and 69, most of them because there was no package or endpoint to check, not because something failed.
Remote endpoints, 7,220 probed
- Answered initialize, open
- 3,686
- Answered, sign-in required
- 2,993
- HTTP 404
- 137
- Unreachable
- 79
- HTTP 530
- 67
- HTTP 503
- 51
- HTTP 402
- 39
- Timed out
- 31
Agent skills, 16,500 scanned
Average score by category
Primary category, 50 or more scanned servers| Category | Servers | Average score |
|---|---|---|
| Filesystem & OS | 51 | 72.0 |
| Memory & Vector Stores | 290 | 72.4 |
| CRM & Marketing | 469 | 72.9 |
| Databases | 301 | 73.3 |
| Media & Content | 278 | 73.3 |
| Workflow Automation | 3,485 | 73.7 |
| Search & Web Data | 1,611 | 74.1 |
| Project Management | 213 | 74.2 |
| Productivity & Office | 3,129 | 74.3 |
| Monitoring & Observability | 110 | 74.5 |
| Design | 321 | 74.6 |
| AI & LLM Tools | 665 | 74.7 |
| Communication | 509 | 74.8 |
| DevOps & Infrastructure | 561 | 74.8 |
| Docs & Knowledge | 578 | 74.8 |
| Commerce & Payments | 242 | 74.9 |
| Developer Tools | 5,459 | 75.5 |
| Finance & Market Data | 1,558 | 76.0 |
| Browser Automation | 404 | 76.4 |
| Science & Research | 405 | 76.7 |
| Cloud Platforms | 169 | 77.1 |
| Security | 1,245 | 77.9 |
What the numbers say, and what they don't
The sample is not random. Our scanner works through indexable listings first, best quality first, so the servers here lean towards the maintained, starred end of the catalog. If anything, the real picture across every MCP server on GitHub is a little worse than this page.
A skipped check is not a failed one. Most servers in the registry publish no npm or PyPI package, so there is no build to attest, no dependency tree to look up in OSV and no package name to compare with popular ones. That is why the provenance bar counts 7,405 packages and not 22,148 servers, and why so many servers land between 50 and 69: the score never counts on fewer than 60 of its 100 points.
The injection pattern is blunt on purpose. It looks for phrases like ignore previous instructions, an IMPORTANT tag or do not tell the user in the description, the README and the tool text, plus Unicode characters that hide text from people but not from the model. Of the 113 servers it matched, 53 (46.9%) call themselves security tools in their name or summary.
vibe-shield, for one, lists ignore previous instructions in the table of patterns it detects. We keep such servers flagged because the model reads that text either way, and each listing's report shows exactly what matched.
Endpoints get one MCP initialize request each. A sign-in answer counts as working: that server wants OAuth or a key, which is normal. Most failures are HTTP 404 responses from servers that moved or were taken down while their registry entry stayed. We leave out per-account URLs like https://{tenant}.example.com/mcp, which nobody can probe.
None of this runs the code. These are checks of public data, not an audit, and a clean report is a starting point for your own review rather than a guarantee.
How every check works · State of MCP, November 2026 · MCP security guide