The State of MCP Security
We audited 797 Model Context Protocol servers (711 repositories + 86 live endpoints) against the OWASP MCP Top 10. Your agent trusts every one of them. It shouldn't.
The real risk: neglect, not malice
We went in expecting the supply-chain horror story — prompt injection, leaked secrets, tool poisoning. The data says otherwise. Across the security-scanned live endpoints, exploit findings are near-zero; what drags the corpus down is abandonment: dead maintenance, missing licenses, and outdated protocol versions.
The tell is the gap between code and deployment. The 711 code-only repositories average 75/100, but the 86 servers someone actually hosts and operates average 80/100. A running deployment is itself a safety signal. The single most security-relevant pattern we found was not an exploit — it was a frozen project that will never receive another security update.
Grade distribution
Where servers lose points
Average share of available points earned per pillar, across all 711 repos. Lower = the ecosystem's weakest link.
Popular ≠ safe
The most-starred MCP servers that still score C or below. Stars measure hype, not safety.
| modelcontextprotocol/servers | ★ 91k | 71C |
| mastra-ai/mastra | ★ 27k | 75C |
| elie222/inbox-zero | ★ 12k | 75C |
| browsermcp/mcp | ★ 7.2k | 66D |
| 21st-dev/magic-mcp | ★ 5.7k | 75C |
| browserbase/mcp-server-browserbase | ★ 3.4k | 54F |
| financial-datasets/mcp-server | ★ 2.3k | 60D |
| irinabuht12-oss/marketing-skills | ★ 2.0k | 73C |
Worst offenders
| openfort-xyz/mcp | ★ 3 | 3F |
| prisma/mcp | ★ 49 | 6F |
| 4everland/4everland-hosting-mcp | ★ 2 | 9F |
| routineco/mcp-server | ★ 3 | 9F |
| digma-ai/digma-mcp-server | ★ 11 | 12F |
| riza-io/riza-mcp | ★ 13 | 12F |
| aws-powertools/powertools-mcp | ★ 42 | 13F |
| devhub/devhub-cms-mcp | ★ 9 | 16F |
Vet a server before you install it
Four checks, in order — a browser and a terminal are enough.
- 01Maintenance recency
When was the last commit? Is the issue tracker a graveyard? A dead server will not get fixed when the spec moves.
- 02License
A real LICENSE file, not a hopeful README line. No license = no legal right to use it, and it blocks enterprise adoption (OWASP MCP04).
- 03Protocol version
Which MCP revision does it implement — and Streamable HTTP, or only legacy SSE? Spec drift is the quiet failure mode.
- 04Tool-schema sanity
Read tools/list. Typed schemas or free-form strings? It is injected into your model context every session — bloat costs tokens and reliability.
Don't ship on a bad score.
Audit any MCP server free, then protect every call to it in real time — cache reads (30–60% off your Claude bill) and block injection / exfiltration / secret leaks with the mcpizy proxy.
Methodology: each server is probed and scored 0–100 against the OWASP MCP Top 10 (security, token cost, tool design, compliance, reliability). Repos are scored on repository quality (maintenance, license, adoption, docs). Data refreshes hourly · 711 repos + 86 endpoints · browse the full directory.