Public dashboard · Last refresh 44m ago

The State of MCP Security

Name: State of MCP Security — live registry telemetry
Creator: MCPSafe
License: https://creativecommons.org/licenses/by/4.0/

Live numbers from MCPSafe’s scan cache. Updated every few minutes as new servers are scanned.

Packages scanned

562

Graded A or B

371

66% of catalog

Graded D or F

2% of catalog

Total findings

8,474

across latest scans

Grade distribution

A81(14%)
B290(52%)
C

Top finding categories

server configuration
5,845
readiness
5,076
resource exhaustion
3,000
ansi escape injection
1,754
verbose errors
1,538
vulnerable dependency
323
data exfiltration
234
xxe
200
insecure container image
197
behavioral mismatch
195

By package source

How the catalog splits across npm, PyPI, GitHub, and Docker Hub — and which source ships the safest MCP servers on average.

GitHub

88%

495

scanned

Avg score: 78.2
Graded A/B: 317 (64%)
Graded D/F: 5
Findings: 7,936

npm

11%

scanned

Avg score: 82.7
Graded A/B: 52 (84%)
Graded D/F: 5
Findings: 416

PyPI

scanned

Avg score: 70.6
Graded A/B: 2 (40%)
Graded D/F: 2
Findings: 122

Top publishers

squatguard
5
microsoft
4
Bigred97
4
sathergate
3
Clawdio777
2
punkpeye
2
jgravelle
2
clay-good
2
cloudflare
2
gc10-commits
2

Notable recent findings

Packages flagged for high risk on their most recent scan. “Flagged” means our rules found issues worth a human review — not that the package is malicious.

Get the monthly State of MCP Security in your inbox.

One email per month. Quotable stats, new threat patterns, and the packages worth watching. Unsubscribe anytime.

Share:X / Twitter LinkedIn

How these numbers are built

Every counter is derived from the most recent scan of each package in our cache. Older scans do not double-count.
Grade distribution uses the same A–F scale shown on the scan report. See /threats for the detection categories behind each finding.
Top publishers are inferred from GitHub package URLs (the owner in github.com/owner/repo). Packages from npm, PyPI, and Docker don’t count here today.
Browse the full catalog from the registry.

Frequently asked

What is an MCP server?

Model Context Protocol (MCP) servers expose tools, resources, and prompts to AI agents. They sit between an LLM and an underlying system — your filesystem, a database, an API — and execute privileged actions on the agent's behalf, which makes their security profile materially different from a typical web service.

Where does this data come from?

Every counter is derived from the most recent MCPSafe scan of each public MCP server in our cache. Older scans don't double-count. Findings are produced by the same rule engine that powers individual scan reports — see our methodology page for the rubric.

How is the safety grade calculated?

Each server gets a 0-100 safety score that combines static analysis findings, supply-chain signals (typosquatting, CVEs), permission and network posture, and LLM-judged behavioral risks. Scores map to A through F bands. The full scoring rubric is published — we don't keep it secret.

How often is this dashboard updated?

The dashboard re-reads its source-of-truth aggregate every few minutes. Individual server scans are re-run when their version changes, when a new rule ships, or on demand from the public registry.

Can I scan a private MCP server?

Public scans are free and require no account. Private repository scanning is available on paid plans — see the pricing page for details.

Can I cite or embed this data?

Yes — the dataset is intended to be quoted in research, blog posts, and security write-ups. Please link back to this page and credit MCPSafe. An embeddable widget for partner sites is on the roadmap.