{
  "dataset": "Canopii MCP Security Index",
  "edition": "2026-09",
  "capturedAt": "2026-09-01T00:33:10.332Z",
  "source": "https://index.canopii.dev/mcp-security-index/2026-09",
  "license": "https://creativecommons.org/licenses/by/4.0/",
  "attribution": "Canopii Trust Index",
  "corpus": {
    "scored": 21010,
    "pending": 0,
    "servers": 27292,
    "liveProbed": 4550,
    "unverifiable": 6282
  },
  "grades": [
    {
      "n": 7510,
      "pct": 36,
      "grade": "A"
    },
    {
      "n": 10280,
      "pct": 49,
      "grade": "B"
    },
    {
      "n": 536,
      "pct": 3,
      "grade": "C"
    },
    {
      "n": 1806,
      "pct": 9,
      "grade": "D"
    },
    {
      "n": 878,
      "pct": 4,
      "grade": "F"
    }
  ],
  "controls": [
    {
      "id": "code.no_command_injection",
      "fail": 557,
      "pass": 18624,
      "warn": 192,
      "guard": true,
      "title": "No command-injection sinks",
      "domain": "code_safety",
      "weight": 10,
      "failPct": 3,
      "evaluated": 19373,
      "notChecked": 1637,
      "notApplicable": 0
    },
    {
      "id": "code.no_code_eval",
      "fail": 218,
      "pass": 19113,
      "warn": 42,
      "guard": true,
      "title": "No dynamic code execution",
      "domain": "code_safety",
      "weight": 8,
      "failPct": 1,
      "evaluated": 19373,
      "notChecked": 1637,
      "notApplicable": 0
    },
    {
      "id": "code.no_path_traversal",
      "fail": 0,
      "pass": 15956,
      "warn": 3417,
      "guard": true,
      "title": "No path traversal",
      "domain": "code_safety",
      "weight": 7,
      "failPct": 0,
      "evaluated": 19373,
      "notChecked": 1637,
      "notApplicable": 0
    },
    {
      "id": "code.no_ssrf",
      "fail": 0,
      "pass": 13203,
      "warn": 6170,
      "guard": true,
      "title": "No SSRF sinks",
      "domain": "code_safety",
      "weight": 6,
      "failPct": 0,
      "evaluated": 19373,
      "notChecked": 1637,
      "notApplicable": 0
    },
    {
      "id": "code.no_unsafe_deserialize",
      "fail": 95,
      "pass": 19268,
      "warn": 10,
      "guard": true,
      "title": "No unsafe deserialization",
      "domain": "code_safety",
      "weight": 6,
      "failPct": 0,
      "evaluated": 19373,
      "notChecked": 1637,
      "notApplicable": 0
    },
    {
      "id": "secrets.no_committed_secrets",
      "fail": 0,
      "pass": 19373,
      "warn": 0,
      "guard": true,
      "title": "No committed secrets",
      "domain": "secrets",
      "weight": 10,
      "failPct": 0,
      "evaluated": 19373,
      "notChecked": 1637,
      "notApplicable": 0
    },
    {
      "id": "secrets.from_env",
      "fail": 0,
      "pass": 12390,
      "warn": 6983,
      "guard": false,
      "title": "Credentials sourced from environment",
      "domain": "secrets",
      "weight": 3,
      "failPct": 0,
      "evaluated": 19373,
      "notChecked": 1637,
      "notApplicable": 0
    },
    {
      "id": "supply.no_known_vulns",
      "fail": 0,
      "pass": 10282,
      "warn": 3393,
      "guard": false,
      "title": "No known-vulnerable dependencies",
      "domain": "supply_chain",
      "weight": 9,
      "failPct": 0,
      "evaluated": 13675,
      "notChecked": 5706,
      "notApplicable": 1629
    },
    {
      "id": "supply.deps_pinned",
      "fail": 0,
      "pass": 4999,
      "warn": 14374,
      "guard": false,
      "title": "Dependencies pinned (lockfile)",
      "domain": "supply_chain",
      "weight": 5,
      "failPct": 0,
      "evaluated": 19373,
      "notChecked": 1637,
      "notApplicable": 0
    },
    {
      "id": "supply.no_install_scripts",
      "fail": 350,
      "pass": 7310,
      "warn": 0,
      "guard": true,
      "title": "No install/post-install scripts",
      "domain": "supply_chain",
      "weight": 5,
      "failPct": 5,
      "evaluated": 7660,
      "notChecked": 3059,
      "notApplicable": 10291
    },
    {
      "id": "supply.not_typosquatting",
      "fail": 8,
      "pass": 10672,
      "warn": 0,
      "guard": true,
      "title": "Package name not typosquatting",
      "domain": "supply_chain",
      "weight": 6,
      "failPct": 0,
      "evaluated": 10680,
      "notChecked": 39,
      "notApplicable": 10291
    },
    {
      "id": "supply.provenance",
      "fail": 0,
      "pass": 1753,
      "warn": 5907,
      "guard": false,
      "title": "Published with provenance",
      "domain": "supply_chain",
      "weight": 3,
      "failPct": 0,
      "evaluated": 7660,
      "notChecked": 3059,
      "notApplicable": 10291
    },
    {
      "id": "supply.maintainer_established",
      "fail": 0,
      "pass": 1045,
      "warn": 9635,
      "guard": false,
      "title": "Established maintainer",
      "domain": "supply_chain",
      "weight": 3,
      "failPct": 0,
      "evaluated": 10680,
      "notChecked": 39,
      "notApplicable": 10291
    },
    {
      "id": "tool.no_injection_markers",
      "fail": 246,
      "pass": 15728,
      "warn": 0,
      "guard": true,
      "title": "Tool descriptions free of injection markers",
      "domain": "tool_integrity",
      "weight": 9,
      "failPct": 2,
      "evaluated": 15974,
      "notChecked": 5036,
      "notApplicable": 0
    },
    {
      "id": "tool.schemas_strict",
      "fail": 0,
      "pass": 1655,
      "warn": 13044,
      "guard": false,
      "title": "Strict tool input schemas",
      "domain": "tool_integrity",
      "weight": 4,
      "failPct": 0,
      "evaluated": 14699,
      "notChecked": 6311,
      "notApplicable": 0
    },
    {
      "id": "tool.no_rug_pull",
      "fail": 9,
      "pass": 4669,
      "warn": 1048,
      "guard": true,
      "title": "No risky post-publish tool changes (rug-pull)",
      "domain": "tool_integrity",
      "weight": 6,
      "failPct": 0,
      "evaluated": 5726,
      "notChecked": 0,
      "notApplicable": 15284
    },
    {
      "id": "tool.no_destructive_scope",
      "fail": 310,
      "pass": 15664,
      "warn": 0,
      "guard": true,
      "title": "No over-broad / destructive tools",
      "domain": "tool_integrity",
      "weight": 4,
      "failPct": 2,
      "evaluated": 15974,
      "notChecked": 5036,
      "notApplicable": 0
    },
    {
      "id": "transport.uses_tls",
      "fail": 0,
      "pass": 9275,
      "warn": 0,
      "guard": true,
      "title": "Remote endpoints use TLS",
      "domain": "auth_transport",
      "weight": 7,
      "failPct": 0,
      "evaluated": 9275,
      "notChecked": 0,
      "notApplicable": 11735
    },
    {
      "id": "auth.declared",
      "fail": 0,
      "pass": 1248,
      "warn": 8027,
      "guard": false,
      "title": "Authentication declared",
      "domain": "auth_transport",
      "weight": 5,
      "failPct": 0,
      "evaluated": 9275,
      "notChecked": 0,
      "notApplicable": 11735
    },
    {
      "id": "deploy.sandboxed",
      "fail": 0,
      "pass": 3838,
      "warn": 15535,
      "guard": false,
      "title": "Execution sandboxing",
      "domain": "auth_transport",
      "weight": 3,
      "failPct": 0,
      "evaluated": 19373,
      "notChecked": 1637,
      "notApplicable": 0
    },
    {
      "id": "dynamic.reachable",
      "fail": 0,
      "pass": 0,
      "warn": 0,
      "guard": false,
      "title": "Live endpoint reachable",
      "domain": "auth_transport",
      "weight": 3,
      "failPct": 0,
      "evaluated": 0,
      "notChecked": 0,
      "notApplicable": 21010
    },
    {
      "id": "dynamic.auth_enforced",
      "fail": 0,
      "pass": 0,
      "warn": 0,
      "guard": false,
      "title": "Authentication enforced",
      "domain": "auth_transport",
      "weight": 4,
      "failPct": 0,
      "evaluated": 0,
      "notChecked": 0,
      "notApplicable": 21010
    },
    {
      "id": "transport.no_bind_all",
      "fail": 0,
      "pass": 16573,
      "warn": 2800,
      "guard": false,
      "title": "No bind-all / exposed debug",
      "domain": "auth_transport",
      "weight": 3,
      "failPct": 0,
      "evaluated": 19373,
      "notChecked": 1637,
      "notApplicable": 0
    },
    {
      "id": "maint.actively_maintained",
      "fail": 0,
      "pass": 17722,
      "warn": 602,
      "guard": false,
      "title": "Actively maintained",
      "domain": "maintenance",
      "weight": 4,
      "failPct": 0,
      "evaluated": 18324,
      "notChecked": 2686,
      "notApplicable": 0
    },
    {
      "id": "maint.not_archived",
      "fail": 198,
      "pass": 18126,
      "warn": 0,
      "guard": true,
      "title": "Repository not archived",
      "domain": "maintenance",
      "weight": 2,
      "failPct": 1,
      "evaluated": 18324,
      "notChecked": 2686,
      "notApplicable": 0
    },
    {
      "id": "gov.declares_license",
      "fail": 0,
      "pass": 14525,
      "warn": 3799,
      "guard": false,
      "title": "Declares a license",
      "domain": "maintenance",
      "weight": 3,
      "failPct": 0,
      "evaluated": 18324,
      "notChecked": 2686,
      "notApplicable": 0
    },
    {
      "id": "gov.security_policy",
      "fail": 0,
      "pass": 4149,
      "warn": 15224,
      "guard": false,
      "title": "Has a security policy",
      "domain": "maintenance",
      "weight": 2,
      "failPct": 0,
      "evaluated": 19373,
      "notChecked": 1637,
      "notApplicable": 0
    },
    {
      "id": "gov.signed_releases",
      "fail": 0,
      "pass": 0,
      "warn": 0,
      "guard": false,
      "title": "Signed releases",
      "domain": "maintenance",
      "weight": 2,
      "failPct": 0,
      "evaluated": 0,
      "notChecked": 21010,
      "notApplicable": 0
    },
    {
      "id": "reputation.adoption",
      "fail": 0,
      "pass": 8759,
      "warn": 10589,
      "guard": false,
      "title": "Adoption & popularity",
      "domain": "maintenance",
      "weight": 2,
      "failPct": 0,
      "evaluated": 19348,
      "notChecked": 1662,
      "notApplicable": 0
    }
  ],
  "headline": {
    "dfPct": 13,
    "noAuthPct": 38,
    "secretsPct": 0,
    "codeSafetyPct": 4,
    "authTheaterPct": 2,
    "toolPoisoningPct": 1
  },
  "confidence": [
    {
      "dfPct": 6,
      "label": "High (80%+ verified)",
      "servers": 16692,
      "avgScore": 85
    },
    {
      "dfPct": 4,
      "label": "60–80% verified",
      "servers": 2681,
      "avgScore": 78
    },
    {
      "dfPct": 100,
      "label": "Low (under 40% verified)",
      "servers": 1637,
      "avgScore": 40
    }
  ],
  "ecosystems": [
    {
      "dfPct": 21,
      "label": "repo / remote-only",
      "servers": 9952,
      "avgScore": 75
    },
    {
      "dfPct": 4,
      "label": "npm",
      "servers": 7668,
      "avgScore": 86
    },
    {
      "dfPct": 8,
      "label": "pypi",
      "servers": 3037,
      "avgScore": 82
    },
    {
      "dfPct": 3,
      "label": "mcpb",
      "servers": 231,
      "avgScore": 86
    },
    {
      "dfPct": 4,
      "label": "nuget",
      "servers": 89,
      "avgScore": 88
    },
    {
      "dfPct": 6,
      "label": "cargo",
      "servers": 33,
      "avgScore": 84
    }
  ],
  "generatedAt": "2026-09-01T00:33:10.331Z",
  "toolSurface": [
    {
      "dfPct": 4,
      "label": "No tools",
      "servers": 5036,
      "avgScore": 81
    },
    {
      "dfPct": 14,
      "label": "1–5 tools",
      "servers": 6278,
      "avgScore": 81
    },
    {
      "dfPct": 15,
      "label": "6–20 tools",
      "servers": 6786,
      "avgScore": 81
    },
    {
      "dfPct": 20,
      "label": "20+ tools",
      "servers": 2910,
      "avgScore": 76
    }
  ],
  "scoreSummary": {
    "max": 100,
    "min": 11,
    "p25": 80,
    "p75": 91,
    "mean": 80.3,
    "median": 88
  },
  "scoringVersion": "2.9.0",
  "popularityStars": [
    {
      "dfPct": 22,
      "label": "1,000+ stars",
      "servers": 229,
      "avgScore": 73
    },
    {
      "dfPct": 14,
      "label": "100–999 stars",
      "servers": 950,
      "avgScore": 78
    },
    {
      "dfPct": 12,
      "label": "10–99 stars",
      "servers": 2192,
      "avgScore": 80
    },
    {
      "dfPct": 4,
      "label": "Under 10 stars",
      "servers": 14953,
      "avgScore": 85
    }
  ],
  "popularityDownloads": [
    {
      "dfPct": 12,
      "label": "100k+/month",
      "servers": 34,
      "avgScore": 82
    },
    {
      "dfPct": 13,
      "label": "10k–100k/month",
      "servers": 93,
      "avgScore": 78
    },
    {
      "dfPct": 7,
      "label": "1k–10k/month",
      "servers": 1330,
      "avgScore": 84
    },
    {
      "dfPct": 4,
      "label": "Under 1k/month",
      "servers": 5945,
      "avgScore": 86
    }
  ]
}