November 2026 edition
The MCP Security Index
We independently scanned 44,242 Model Context Protocol servers. 28% scored D or F, 0% ship committed secrets, and 53% declare no authentication at all.
Frozen · captured · scoring rubric v2.11.0 · methodology
- Graded D or F
- 28%no change
- Committed secrets
- 0%no change
- No declared auth
- 53%no change
- Graded A
- 31%−1%
12,388 of 44,242 scanned servers carry a failing or near-failing security grade.
Live credentials found in published source — an attacker can use these as-is.
No OAuth 2.1 or protected-resource metadata gating who may invoke the server's tools.
13,891 servers verifiably pass the controls that apply to them.
Grade distribution
The median MCP server scores 85/100. Half the corpus falls between 40 and 90.
44,242 scored servers
| Mean score | 71.9 |
| Median score | 85 |
| 25th percentile | 40 |
| 75th percentile | 90 |
| Lowest score | 12 |
| Highest score | 100 |
Popularity does not mean safety
Adoption and security posture move independently. The most-installed servers are not the safest ones.
By GitHub stars
| Cohort | servers | Average score | Graded D/F |
|---|---|---|---|
| 1,000+ stars | 353 | 78 | 15% |
| 100–999 stars | 1,341 | 79 | 13% |
| 10–99 stars | 3,126 | 80 | 10% |
| Under 10 stars | 27,819 | 80 | 10% |
By monthly downloads
| Cohort | servers | Average score | Graded D/F |
|---|---|---|---|
| 100k+/month | 42 | 83 | 10% |
| 10k–100k/month | 145 | 79 | 12% |
| 1k–10k/month | 2,111 | 85 | 7% |
| Under 1k/month | 11,138 | 80 | 18% |
Authentication and live exposure
We reached 3,095 live MCP endpoints. Of those, 3% declared that authentication was required and then served their tool surface to an anonymous caller.
- Live endpoints probed
- 3,095
- Auth declared but not enforced
- 3%
- Tool-poisoning markers
- 6%
Servers we connected to and spoke MCP with directly.
Of probed endpoints — documented auth that anonymous callers get straight past.
Hidden instructions found in tool descriptions, which hijack the calling agent.
Attack surface and ecosystem
More exposed tools means more ways to be wrong. Ecosystem mix shows where the risk concentrates.
By number of exposed tools
| Cohort | servers | Average score | Graded D/F |
|---|---|---|---|
| No tools | 9,494 | 82 | 4% |
| 1–5 tools | 12,723 | 71 | 37% |
| 6–20 tools | 12,808 | 72 | 34% |
| 20+ tools | 9,217 | 63 | 35% |
By package ecosystem
| Cohort | servers | Average score | Graded D/F |
|---|---|---|---|
| repo / remote-only | 24,669 | 65 | 40% |
| npm | 14,226 | 81 | 15% |
| pypi | 4,413 | 81 | 8% |
| mcpb | 702 | 84 | 4% |
| nuget | 140 | 88 | 5% |
| cargo | 92 | 87 | 3% |
What the ecosystem fails most
Every control in the catalog, ranked by failure rate within each domain. Failure rates are a share of servers where the control actually applied and could be evaluated.
Code safety
| Control | Failure rate | Failed | Warned | Evaluated |
|---|---|---|---|---|
| No command-injection sinksGuardcode.no_command_injection | 2% | 666 | 323 | 35,088 |
| No dynamic code executionGuardcode.no_code_eval | 1% | 357 | 147 | 35,088 |
| No unsafe deserializationGuardcode.no_unsafe_deserialize | 0% | 97 | 25 | 35,088 |
| No path traversalGuardcode.no_path_traversal | 0% | 0 | 9,329 | 35,088 |
| No SSRF sinksGuardcode.no_ssrf | 0% | 0 | 11,018 | 35,088 |
Secrets & credentials
| Control | Failure rate | Failed | Warned | Evaluated |
|---|---|---|---|---|
| No committed secretsGuardsecrets.no_committed_secrets | 0% | 0 | 0 | 35,088 |
| Credentials sourced from environmentsecrets.from_env | 0% | 0 | 12,952 | 35,088 |
Dependencies & supply chain
| Control | Failure rate | Failed | Warned | Evaluated |
|---|---|---|---|---|
| No install/post-install scriptsGuardsupply.no_install_scripts | 3% | 407 | 0 | 14,223 |
| Package name not typosquattingGuardsupply.not_typosquatting | 0% | 13 | 0 | 18,614 |
| No known-vulnerable dependenciessupply.no_known_vulns | 0% | 0 | 5,128 | 23,580 |
| Dependencies pinned (lockfile)supply.deps_pinned | 0% | 0 | 26,827 | 35,088 |
| Published with provenancesupply.provenance | 0% | 0 | 9,329 | 14,223 |
| Established maintainersupply.maintainer_established | 0% | 0 | 15,764 | 18,614 |
Tool integrity
| Control | Failure rate | Failed | Warned | Evaluated |
|---|---|---|---|---|
| No over-broad / destructive toolsGuardtool.no_destructive_scope | 8% | 2,839 | 0 | 34,748 |
| Tool descriptions free of injection markersGuardtool.no_injection_markers | 7% | 2,505 | 0 | 34,748 |
| No risky post-publish tool changes (rug-pull)Guardtool.no_rug_pull | 0% | 54 | 4,155 | 13,716 |
| No in-session tool-definition changesGuardtool.no_runtime_mutation | 0% | 1 | 36 | 24,405 |
| Strict tool input schemastool.schemas_strict | 0% | 0 | 22,763 | 26,614 |
Auth & transport
| Control | Failure rate | Failed | Warned | Evaluated |
|---|---|---|---|---|
| Origin validated (DNS-rebinding protection)transport.origin_validated | 3% | 125 | 2,730 | 3,586 |
| No token passthroughGuardauth.no_token_passthrough | 1% | 110 | 62 | 13,232 |
| Remote endpoints use TLSGuardtransport.uses_tls | 0% | 0 | 0 | 26,012 |
| Authentication declaredauth.declared | 0% | 0 | 23,350 | 26,012 |
| Execution sandboxingdeploy.sandboxed | 0% | 0 | 29,137 | 35,088 |
| Live endpoint reachabledynamic.reachable | 0% | 0 | 0 | 0 |
| Authentication enforceddynamic.auth_enforced | 0% | 0 | 0 | 0 |
| No bind-all / exposed debugtransport.no_bind_all | 0% | 0 | 4,360 | 35,088 |
Maintenance & governance
| Control | Failure rate | Failed | Warned | Evaluated |
|---|---|---|---|---|
| Repository not archivedGuardmaint.not_archived | 1% | 364 | 0 | 32,639 |
| Actively maintainedmaint.actively_maintained | 0% | 0 | 1,716 | 32,639 |
| Declares a licensegov.declares_license | 0% | 0 | 8,388 | 32,639 |
| Has a security policygov.security_policy | 0% | 0 | 28,617 | 35,088 |
| Signed releasesgov.signed_releases | 0% | 0 | 0 | 0 |
| Adoption & popularityreputation.adoption | 0% | 0 | 20,301 | 34,995 |
How much we could verify
Absence of evidence is not safety. A partially-scannable server cannot present a high score, so confidence caps it.
| Cohort | servers | Average score | Graded D/F |
|---|---|---|---|
| High (80%+ verified) | 29,827 | 81 | 11% |
| 60–80% verified | 5,261 | 78 | 3% |
| Low (under 40% verified) | 9,154 | 40 | 100% |
A further 12,341 listed servers declare no public repository or their source cannot be retrieved. They are listed without a score rather than given an invented one.
How to read these numbers
- How often does the MCP Security Index update?
- The live page recomputes from the database continuously; a permanent edition is frozen at the end of every calendar month at /mcp-security-index/YYYY-MM. Servers themselves are re-ingested and re-scanned every six hours, so a score change shows up on the live page the same day.
- What does a D or F grade actually mean?
- Grades come from a 0–100 score: A is 90 and up, B 75–89, C 60–74, D 40–59, F below 40. A confirmed security flaw caps the score outright — a server with a verified command-injection sink cannot exceed 20 no matter how good the rest of it is — so D and F overwhelmingly indicate a specific, evidenced problem rather than a general lack of polish.
- Are month-over-month deltas comparing the same servers?
- No. Distribution deltas cover the whole corpus, which grows as new servers are ingested, so part of any shift is composition rather than servers changing. The 'biggest score drops' section is the cohort-stable view: those are specific servers that were re-scanned and scored lower than before.
- Why are some listed servers not scored at all?
- If a server declares no public repository, or its source cannot be retrieved because it is private, moved, or removed, there is nothing to verify. Those are listed as unverified with no score rather than given an invented number, and they are excluded from every percentage on this page.
- What counts as 'no authentication'?
- A server that declares no authentication mechanism — no OAuth 2.1, no protected-resource metadata — so nothing gates who may invoke its tools. Separately, among servers whose live endpoints we probed, some declare that auth is required and then serve their full tool surface to an anonymous caller; that is reported as 'auth declared but not enforced'.
- Can I use these numbers in my own work?
- Yes. The full dataset behind each edition is downloadable as JSON and CSV from the page itself. Cite the Canopii Trust Index and link to the specific monthly edition you used, so the numbers you quoted remain verifiable.
Take the data
Every number on this page is downloadable. Attribution to the Canopii Trust Index is all we ask.
Looking for a specific server? Browse the full directory — every server page shows its complete control checklist with the evidence behind each result.