{
  "dataset": "Canopii MCP Security Index",
  "edition": "2026-10",
  "capturedAt": "2026-10-01T16:31:11.524Z",
  "source": "https://index.canopii.dev/mcp-security-index/2026-10",
  "license": "https://creativecommons.org/licenses/by/4.0/",
  "attribution": "Canopii Trust Index",
  "corpus": {
    "scored": 31782,
    "pending": 0,
    "servers": 39655,
    "liveProbed": 3239,
    "unverifiable": 7873
  },
  "grades": [
    {
      "n": 8887,
      "pct": 28,
      "grade": "A"
    },
    {
      "n": 14360,
      "pct": 45,
      "grade": "B"
    },
    {
      "n": 2884,
      "pct": 9,
      "grade": "C"
    },
    {
      "n": 4555,
      "pct": 14,
      "grade": "D"
    },
    {
      "n": 1096,
      "pct": 3,
      "grade": "F"
    }
  ],
  "controls": [
    {
      "id": "code.no_command_injection",
      "fail": 599,
      "pass": 26527,
      "warn": 238,
      "guard": true,
      "title": "No command-injection sinks",
      "domain": "code_safety",
      "weight": 10,
      "failPct": 2,
      "evaluated": 27364,
      "notChecked": 4418,
      "notApplicable": 0
    },
    {
      "id": "code.no_code_eval",
      "fail": 258,
      "pass": 27026,
      "warn": 80,
      "guard": true,
      "title": "No dynamic code execution",
      "domain": "code_safety",
      "weight": 8,
      "failPct": 1,
      "evaluated": 27364,
      "notChecked": 4418,
      "notApplicable": 0
    },
    {
      "id": "code.no_path_traversal",
      "fail": 0,
      "pass": 21002,
      "warn": 6362,
      "guard": true,
      "title": "No path traversal",
      "domain": "code_safety",
      "weight": 7,
      "failPct": 0,
      "evaluated": 27364,
      "notChecked": 4418,
      "notApplicable": 0
    },
    {
      "id": "code.no_ssrf",
      "fail": 0,
      "pass": 18952,
      "warn": 8412,
      "guard": true,
      "title": "No SSRF sinks",
      "domain": "code_safety",
      "weight": 6,
      "failPct": 0,
      "evaluated": 27364,
      "notChecked": 4418,
      "notApplicable": 0
    },
    {
      "id": "code.no_unsafe_deserialize",
      "fail": 98,
      "pass": 27249,
      "warn": 17,
      "guard": true,
      "title": "No unsafe deserialization",
      "domain": "code_safety",
      "weight": 6,
      "failPct": 0,
      "evaluated": 27364,
      "notChecked": 4418,
      "notApplicable": 0
    },
    {
      "id": "secrets.no_committed_secrets",
      "fail": 0,
      "pass": 27364,
      "warn": 0,
      "guard": true,
      "title": "No committed secrets",
      "domain": "secrets",
      "weight": 10,
      "failPct": 0,
      "evaluated": 27364,
      "notChecked": 4418,
      "notApplicable": 0
    },
    {
      "id": "secrets.from_env",
      "fail": 0,
      "pass": 15781,
      "warn": 11583,
      "guard": false,
      "title": "Credentials sourced from environment",
      "domain": "secrets",
      "weight": 3,
      "failPct": 0,
      "evaluated": 27364,
      "notChecked": 4418,
      "notApplicable": 0
    },
    {
      "id": "supply.no_known_vulns",
      "fail": 0,
      "pass": 13485,
      "warn": 3803,
      "guard": false,
      "title": "No known-vulnerable dependencies",
      "domain": "supply_chain",
      "weight": 9,
      "failPct": 0,
      "evaluated": 17288,
      "notChecked": 10089,
      "notApplicable": 4405
    },
    {
      "id": "supply.deps_pinned",
      "fail": 0,
      "pass": 6189,
      "warn": 21175,
      "guard": false,
      "title": "Dependencies pinned (lockfile)",
      "domain": "supply_chain",
      "weight": 5,
      "failPct": 0,
      "evaluated": 27364,
      "notChecked": 4418,
      "notApplicable": 0
    },
    {
      "id": "supply.no_install_scripts",
      "fail": 381,
      "pass": 9606,
      "warn": 0,
      "guard": true,
      "title": "No install/post-install scripts",
      "domain": "supply_chain",
      "weight": 5,
      "failPct": 4,
      "evaluated": 9987,
      "notChecked": 3604,
      "notApplicable": 18191
    },
    {
      "id": "supply.not_typosquatting",
      "fail": 10,
      "pass": 13537,
      "warn": 0,
      "guard": true,
      "title": "Package name not typosquatting",
      "domain": "supply_chain",
      "weight": 6,
      "failPct": 0,
      "evaluated": 13547,
      "notChecked": 44,
      "notApplicable": 18191
    },
    {
      "id": "supply.provenance",
      "fail": 0,
      "pass": 2242,
      "warn": 7745,
      "guard": false,
      "title": "Published with provenance",
      "domain": "supply_chain",
      "weight": 3,
      "failPct": 0,
      "evaluated": 9987,
      "notChecked": 3604,
      "notApplicable": 18191
    },
    {
      "id": "supply.maintainer_established",
      "fail": 0,
      "pass": 1393,
      "warn": 12154,
      "guard": false,
      "title": "Established maintainer",
      "domain": "supply_chain",
      "weight": 3,
      "failPct": 0,
      "evaluated": 13547,
      "notChecked": 44,
      "notApplicable": 18191
    },
    {
      "id": "tool.no_injection_markers",
      "fail": 403,
      "pass": 24798,
      "warn": 0,
      "guard": true,
      "title": "Tool descriptions free of injection markers",
      "domain": "tool_integrity",
      "weight": 9,
      "failPct": 2,
      "evaluated": 25201,
      "notChecked": 6581,
      "notApplicable": 0
    },
    {
      "id": "tool.schemas_strict",
      "fail": 0,
      "pass": 2516,
      "warn": 18843,
      "guard": false,
      "title": "Strict tool input schemas",
      "domain": "tool_integrity",
      "weight": 4,
      "failPct": 0,
      "evaluated": 21359,
      "notChecked": 10423,
      "notApplicable": 0
    },
    {
      "id": "tool.no_rug_pull",
      "fail": 25,
      "pass": 7281,
      "warn": 1856,
      "guard": true,
      "title": "No risky post-publish tool changes (rug-pull)",
      "domain": "tool_integrity",
      "weight": 6,
      "failPct": 0,
      "evaluated": 9162,
      "notChecked": 0,
      "notApplicable": 22620
    },
    {
      "id": "tool.no_destructive_scope",
      "fail": 2657,
      "pass": 22544,
      "warn": 0,
      "guard": true,
      "title": "No over-broad / destructive tools",
      "domain": "tool_integrity",
      "weight": 4,
      "failPct": 11,
      "evaluated": 25201,
      "notChecked": 6581,
      "notApplicable": 0
    },
    {
      "id": "transport.uses_tls",
      "fail": 0,
      "pass": 17048,
      "warn": 0,
      "guard": true,
      "title": "Remote endpoints use TLS",
      "domain": "auth_transport",
      "weight": 7,
      "failPct": 0,
      "evaluated": 17048,
      "notChecked": 0,
      "notApplicable": 14734
    },
    {
      "id": "auth.declared",
      "fail": 0,
      "pass": 1866,
      "warn": 15182,
      "guard": false,
      "title": "Authentication declared",
      "domain": "auth_transport",
      "weight": 5,
      "failPct": 0,
      "evaluated": 17048,
      "notChecked": 0,
      "notApplicable": 14734
    },
    {
      "id": "deploy.sandboxed",
      "fail": 0,
      "pass": 4647,
      "warn": 22717,
      "guard": false,
      "title": "Execution sandboxing",
      "domain": "auth_transport",
      "weight": 3,
      "failPct": 0,
      "evaluated": 27364,
      "notChecked": 4418,
      "notApplicable": 0
    },
    {
      "id": "dynamic.reachable",
      "fail": 0,
      "pass": 0,
      "warn": 0,
      "guard": false,
      "title": "Live endpoint reachable",
      "domain": "auth_transport",
      "weight": 3,
      "failPct": 0,
      "evaluated": 0,
      "notChecked": 0,
      "notApplicable": 31782
    },
    {
      "id": "dynamic.auth_enforced",
      "fail": 0,
      "pass": 0,
      "warn": 0,
      "guard": false,
      "title": "Authentication enforced",
      "domain": "auth_transport",
      "weight": 4,
      "failPct": 0,
      "evaluated": 0,
      "notChecked": 0,
      "notApplicable": 31782
    },
    {
      "id": "transport.no_bind_all",
      "fail": 0,
      "pass": 23972,
      "warn": 3392,
      "guard": false,
      "title": "No bind-all / exposed debug",
      "domain": "auth_transport",
      "weight": 3,
      "failPct": 0,
      "evaluated": 27364,
      "notChecked": 4418,
      "notApplicable": 0
    },
    {
      "id": "maint.actively_maintained",
      "fail": 0,
      "pass": 24834,
      "warn": 780,
      "guard": false,
      "title": "Actively maintained",
      "domain": "maintenance",
      "weight": 4,
      "failPct": 0,
      "evaluated": 25614,
      "notChecked": 6168,
      "notApplicable": 0
    },
    {
      "id": "maint.not_archived",
      "fail": 226,
      "pass": 25388,
      "warn": 0,
      "guard": true,
      "title": "Repository not archived",
      "domain": "maintenance",
      "weight": 2,
      "failPct": 1,
      "evaluated": 25614,
      "notChecked": 6168,
      "notApplicable": 0
    },
    {
      "id": "gov.declares_license",
      "fail": 0,
      "pass": 18176,
      "warn": 7438,
      "guard": false,
      "title": "Declares a license",
      "domain": "maintenance",
      "weight": 3,
      "failPct": 0,
      "evaluated": 25614,
      "notChecked": 6168,
      "notApplicable": 0
    },
    {
      "id": "gov.security_policy",
      "fail": 0,
      "pass": 4977,
      "warn": 22387,
      "guard": false,
      "title": "Has a security policy",
      "domain": "maintenance",
      "weight": 2,
      "failPct": 0,
      "evaluated": 27364,
      "notChecked": 4418,
      "notApplicable": 0
    },
    {
      "id": "gov.signed_releases",
      "fail": 0,
      "pass": 0,
      "warn": 0,
      "guard": false,
      "title": "Signed releases",
      "domain": "maintenance",
      "weight": 2,
      "failPct": 0,
      "evaluated": 0,
      "notChecked": 31782,
      "notApplicable": 0
    },
    {
      "id": "reputation.adoption",
      "fail": 0,
      "pass": 10040,
      "warn": 16755,
      "guard": false,
      "title": "Adoption & popularity",
      "domain": "maintenance",
      "weight": 2,
      "failPct": 0,
      "evaluated": 26795,
      "notChecked": 4987,
      "notApplicable": 0
    }
  ],
  "headline": {
    "dfPct": 18,
    "noAuthPct": 48,
    "secretsPct": 0,
    "codeSafetyPct": 3,
    "authTheaterPct": 3,
    "toolPoisoningPct": 1
  },
  "confidence": [
    {
      "dfPct": 5,
      "label": "High (80%+ verified)",
      "servers": 23772,
      "avgScore": 83
    },
    {
      "dfPct": 3,
      "label": "60–80% verified",
      "servers": 3592,
      "avgScore": 78
    },
    {
      "dfPct": 100,
      "label": "Low (under 40% verified)",
      "servers": 4418,
      "avgScore": 40
    }
  ],
  "ecosystems": [
    {
      "dfPct": 28,
      "label": "repo / remote-only",
      "servers": 17555,
      "avgScore": 69
    },
    {
      "dfPct": 4,
      "label": "npm",
      "servers": 9992,
      "avgScore": 86
    },
    {
      "dfPct": 7,
      "label": "pypi",
      "servers": 3580,
      "avgScore": 81
    },
    {
      "dfPct": 5,
      "label": "mcpb",
      "servers": 482,
      "avgScore": 84
    },
    {
      "dfPct": 3,
      "label": "nuget",
      "servers": 115,
      "avgScore": 89
    },
    {
      "dfPct": 5,
      "label": "cargo",
      "servers": 58,
      "avgScore": 86
    }
  ],
  "generatedAt": "2026-10-01T16:31:11.523Z",
  "toolSurface": [
    {
      "dfPct": 4,
      "label": "No tools",
      "servers": 6581,
      "avgScore": 82
    },
    {
      "dfPct": 23,
      "label": "1–5 tools",
      "servers": 9844,
      "avgScore": 76
    },
    {
      "dfPct": 25,
      "label": "6–20 tools",
      "servers": 9304,
      "avgScore": 76
    },
    {
      "dfPct": 14,
      "label": "20+ tools",
      "servers": 6053,
      "avgScore": 70
    }
  ],
  "scoreSummary": {
    "max": 100,
    "min": 11,
    "p25": 61,
    "p75": 90,
    "mean": 76.1,
    "median": 86
  },
  "scoringVersion": "2.9.0",
  "popularityStars": [
    {
      "dfPct": 18,
      "label": "1,000+ stars",
      "servers": 297,
      "avgScore": 75
    },
    {
      "dfPct": 14,
      "label": "100–999 stars",
      "servers": 1063,
      "avgScore": 78
    },
    {
      "dfPct": 11,
      "label": "10–99 stars",
      "servers": 2544,
      "avgScore": 80
    },
    {
      "dfPct": 3,
      "label": "Under 10 stars",
      "servers": 21710,
      "avgScore": 82
    }
  ],
  "popularityDownloads": [
    {
      "dfPct": 8,
      "label": "100k+/month",
      "servers": 36,
      "avgScore": 83
    },
    {
      "dfPct": 11,
      "label": "10k–100k/month",
      "servers": 116,
      "avgScore": 79
    },
    {
      "dfPct": 7,
      "label": "1k–10k/month",
      "servers": 1491,
      "avgScore": 84
    },
    {
      "dfPct": 3,
      "label": "Under 1k/month",
      "servers": 6905,
      "avgScore": 86
    }
  ]
}