Method & findings · August 2026
What 2,174 MCP servers actually do, according to their source
Connecting an MCP server hands it a channel into your agent's context and its tool calls. We fetched the published source of every server we could resolve from the official registry and read it. Most of what we found is ordinary and intended — a GitHub server reads a GitHub token because that is the job. We are publishing the distribution, not an accusation.
What we did
We pulled every entry from the official MCP registry, kept the latest version of each package-type server, and fetched its published source from npm. That left 2,238 servers. For 64 we could retrieve only metadata and documentation — no implementation — so those are recorded as not judged rather than as clean. The numbers below are over the 2,174 we actually read.
Each server was read by an LLM under one instruction: report facts, not
verdicts. Every finding must carry a file:line and quote
the code it came from. The pipeline drops any finding whose quoted evidence
cannot be located in the file — if we cannot point at it, we do not report it.
What is in the source
Most of these are not attacks. A server that reads GITHUB_TOKEN
to call the GitHub API is doing its job. The point is not that these are
malicious — it is that you are agreeing to all of it the moment you
connect, and almost nobody reads the source first.
The 4% worth reading before you connect
86 servers contain code that reads private keys, mnemonics, seed phrases, or wallet files. For many of them that is the stated purpose. In some, the key is used to construct a signer that wraps outbound HTTP requests. Whether that is desirable depends entirely on what you intended when you connected the server — which is the point: it is worth knowing beforehand.Findings are not evenly distributed by popularity
We ranked servers by weekly npm downloads and split them into three groups. The difference is larger than we expected.
In our sample, servers with no download signal carry a finding about twice as often as servers people actually install. The two groups were also selected differently — the third was sampled before we ranked by downloads — so this is a difference between samples, not a controlled comparison. The category mix differs as well:
| Category | Popular | Long tail | No signal |
|---|---|---|---|
| Credential access | 13.1% | 11.0% | 26.3% |
| Network egress | 7.9% | 6.4% | 11.3% |
| Install-time execution | 10.3% | 3.9% | 9.5% |
| Prompt-injection surface | 2.0% | 3.9% | 11.3% |
We cannot tell you why
This is a correlation and we are not going to dress it up as a cause. Popular servers may be better engineered, or better reviewed, or simply written by people who avoid the patterns we look for. Our own analyzer may also be easier on well-structured code. Do not read this as “popular means safe.” Nearly one in five popular servers still carries a finding, and install-time execution is more common among them, not less.What we are not claiming
- No finding is not a clean bill of health. It means nothing was found in the categories we check, in the code we could fetch.
- We do not label anything malicious. The pipeline refuses to emit that word about a package, and refuses to emit “safe” too. What you get is the code and where it lives.
- Coverage is npm-published servers only. Remote-only servers and servers we could not resolve are outside these numbers.
- One analyzer, one pass. We measured run-to-run agreement at 93% on a hand-labelled set of 84 servers before running the full corpus. It is not 100%.
Check one yourself
The corpus is queryable. It is an MCP server, so your agent can call it directly; it is also a plain HTTP endpoint.
curl -X POST https://sri-test.biz/v1/verify \
-H 'Content-Type: application/json' \
-d '{"ecosystem":"mcp","name":"io.github.owner/server","version":"1.0.0"}'
Free while settlement runs on Bitcoin signet — no key, no signup. Every
finding comes back with the file:line and the quoted code, so
you can check our work rather than trust it.
If we got one wrong
If you maintain a server and a finding is mistaken, tell us through the report form. Agents can usePOST /v1/disputes.
We reply within three business days.
While we review, the finding may be withheld from results. If we withdraw
it, the server is re-analysed and the record replaced. If we keep it, we say
which facts it rests on.
Corpus of 2,238 servers from the official MCP registry, analyzed August 2026 with Claude Haiku 4.5. 64 could not be judged (no implementation code retrievable). Download counts are npm weekly figures at time of ranking. Percentages are shares of servers with at least one finding in a category, not shares of findings.