Research · data from 30 October 2026
State of MCP server security, October 2026
48,447 MCP servers graded, up from 6,333 in September. 1 in 6 remote servers lists tools that create, send or delete to anyone who connects. A third of graded servers name no source repository, and 1 in 10 names one that no longer exists.
Key findings
remote servers (16%, 241 of 1,534 probed) list tools that create, send or delete to anyone who connects, with no sign-in and no API key. Scaled to the catalogue: roughly 4,300 servers.
of graded servers name no source repository. Another 10% name one that returns "not found": about 4,500 servers whose code link is dead.
of remote servers use OAuth, the sign-in the MCP spec defines. Up from 17% of remote listings in September.
of the 48,447 graded servers get an A or B. 9.7% get a D or F and are hidden from default search or blocked at the gateway.
The catalogue grew eightfold since September and the shape of the risk did not change. Most servers are fine. The problem sits in one place: remote endpoints that answer anyone, and among those, the ones whose tools change things. The second problem is newer and quieter: a third of graded servers give you no code to read, and one in ten points at code that has since vanished.
Grades
Every server is graded A to F on six public components: code, live reliability, tool poisoning, sign-in, maintenance and publisher identity (the rubric). Any critical finding is an F. These are the exact counts for the whole catalogue.
- AGrade A15,387 · 32%
- BGrade B16,439 · 34%
- CGrade C11,903 · 25%
- FD or F (hidden or blocked)4,718 · 10%
In September 79% graded A or B; now 66%. The share of C grew because the registry's growth in 2026 has been mostly remote-only servers without a repository, which lose points on maintenance and identity even when their endpoint behaves.
Remote servers and sign-in
63% of graded servers have a remote endpoint, about 27,600 in the catalogue. For the 1,534 in the sample with a live probe result, what an outside client sees when it connects:
- Open, lists write tools241 · 16%
- Open, read-only tools668 · 44%
- API key required109 · 7%
- Other sign-in enforced108 · 7%
- OAuth403 · 26%
Counted by publisher, so a namespace that publishes two hundred near-identical servers counts once: 209 of the 1,200 publishers with a probed remote server (17%) have at least one open endpoint that lists write tools, against 19% in September. 387 (32%) offer OAuth on at least one server, against 32%. More OAuth, and the open-write share unchanged: the newcomers who adopted sign-in are matched by newcomers who did not.
An open endpoint that lists a write tool lets anyone with the URL use it the way your agent does. Some check a key inside each call; some are public on purpose. The number describes what is visible from outside, not abuse we observed.
Source you cannot read
list no source repository at all.
list a repository that returns 404 or is private.
have code anyone can open and read.
Of 2,384 scanned servers, 780 name no repository and 245 name one that no longer resolves. Scaled to the catalogue, that is roughly 18,800 servers where the only way to know what the code does is to run it. For a remote server the publisher may simply not want to share code; for a package on your machine, a dead repository link is the single most useful warning sign the registry metadata offers. In September 1,155 of 6,333 (18%) listed no repository; the share has nearly doubled as remote-only listings took over the registry.
What the tools can do
1,559 servers in the sample expose a readable tool list, 22,525 tools in all: a median of 7 per server and a mean of 14.4, pulled up by 58 servers with more than fifty. 12% of all tools are write tools, and 37% of servers have at least one.
| Tool can… | Tools in sample | Per 1,000 tools |
|---|---|---|
| delete or remove something | 310 | 14 |
| send, email, post or publish | 202 | 9 |
| pay, purchase or transfer | 128 | 6 |
| execute a command or shell | 76 | 3 |
218 servers (14% of those with a tool list) expose at least one tool that deletes, executes, pays or transfers. The most common tool verbs are the dull ones: get (2,532), list (1,010), search (680), create (474), check (227). delete is the seventh most common verb in the registry, with 217 tools starting with it.
Verified domains vs GitHub namespaces
The registry has two kinds of publisher. A GitHub namespace (io.github.someone) is proven by a GitHub login; a reverse-DNS namespace (com.company) is proven by a DNS or HTTP challenge on that domain, and is how companies publish their official servers. The second group looks safer by name. It grades worse.
| Verified domain | GitHub namespace | |
|---|---|---|
| Share of sample | 39% | 61% |
| Median safety score | 75 | 83 |
| Grade A | 18% | 47% |
| Has a remote endpoint | 93% | 44% |
| Remote with open write tools | 14% | 10% |
| No source repository | 67% | 9% |
Two thirds of verified-domain servers publish no code, and their remote endpoints are more likely to expose write tools openly than hobbyist ones. The grade is not punishing companies for being companies: a hosted product with OAuth and a public repository scores as well as anything. It is recording that "official" in this registry mostly means "hosted, closed, and often open to anyone".
Code and descriptions
42% of scanned servers carry at least one finding and 11% carry a high-severity one. Most findings are the two above: no repository, and open write tools. The code patterns are rare and stable since September: eval or new Function in 44 packages, an npm install-time script in 16, a shell command built from a string in 9, shell=True in 11. 34 servers have a tool description over 2,000 characters, which is where hidden instructions tend to live; none were flagged for instructions aimed at the model.
553 servers (18%) declare at least one secret the user must supply, an API key or token, before the server will work. That is the population to care about when a package's code cannot be read: the key you hand it is the key it can leak.
By category
Sample sizes are small outside the big categories; read the small rows as direction, not decimals. "Open write" is the share of that category's remote servers that expose write tools with no sign-in.
| Category | In sample | Grade A | Remote | Open write | Write tools | No repo |
|---|---|---|---|---|---|---|
| Everything else | 1,643 | 38% | 66% | 10% | 10% | 25% |
| AI and agents | 268 | 37% | 49% | 18% | 17% | 21% |
| Web search | 228 | 31% | 67% | 13% | 10% | 35% |
| E-commerce | 128 | 23% | 70% | 22% | 23% | 35% |
| Finance | 115 | 26% | 63% | 22% | 10% | 23% |
| Media | 94 | 22% | 68% | 16% | 15% | 35% |
| Productivity | 79 | 39% | 56% | 16% | 16% | 22% |
| Developer tools | 70 | 33% | 46% | 16% | 26% | 16% |
| Databases | 65 | 40% | 38% | 12% | 14% | 18% |
| 65 | 34% | 68% | 18% | 30% | 28% | |
| Sales and outbound | 56 | 32% | 82% | 11% | 30% | 34% |
| Scraping and browsing | 54 | 48% | 41% | 9% | 8% | 19% |
| SEO | 50 | 32% | 80% | 8% | 9% | 42% |
| Security | 50 | 36% | 60% | 10% | 9% | 14% |
| Maps and travel | 35 | 23% | 71% | 12% | 3% | 37% |
E-commerce and finance stand out twice: the highest shares of remote endpoints with open write tools (22% and 22%) and among the lowest A-grade rates. Sales and email servers have the highest share of write tools of any category (about 30% of their tools send, create or update something), which is the job, and the reason to keep them behind approval.
Since September
| September 2026 | October 2026 | |
|---|---|---|
| Servers graded | 6,333 | 48,447 |
| Grade A or B | 79% | 66% |
| Remote listings with open write tools | 15% | 16% |
| Remote listings with OAuth | 17% | 26% |
| Publishers with an open-write endpoint | 19% | 17% |
| No source repository | 18% | 33% |
What to do
If you pick servers for a team
- Prefer remote servers with OAuth. With an open endpoint, assume anyone with the URL has the same tools you do.
- Treat a missing or dead repository link as a finding in itself. A third of the registry asks you to trust code you cannot read.
- Keep write tools behind approval in your client. One tool in eight changes something; one server in seven can delete, run or pay.
If you publish a server
- Put OAuth, or at least an API key, in front of any tool that changes something.
- List a repository that resolves. 245 servers in this sample point at one that does not.
- Claim your listing and add the grade badge to your README; a fix is rescanned on your next release. Only 1 of 3,000 sampled servers has been claimed.
Method and limits
- Population. 48,447 servers from the official MCP registry had a grade on 30 October 2026: 15,387 A, 16,439 B, 11,903 C, 4,718 D or F. Those counts are exact.
- Sample. Everything else on this page is measured on 3,000 listings drawn uniformly at random from the 43,717 A, B and C listings in that day's sitemaps and read through the public listing API. At this size a proportion is within ±1.8 points of the population value 95 times in 100. 2,384 of the 3,000 returned a full scan report; sign-in, repository and code figures use that denominator, and the page says so where it matters. D and F listings are not in the sample.
- Remote endpoints. The scanner sends one
initializeand onetools/list, as any client does. No tool is ever called. "Open" means the endpoint answered the tool list with no credential. "Write tools" are tools whose name or description says they create, send, update, delete, post, pay, run or deploy. - Packages. Downloaded from npm or PyPI and read as text. Never installed, never run.
- Automated. Every number comes from rules, not people; each finding is published with its evidence on the server's safety page and can be appealed. The rubric is public. No grade, ranking or badge on MCP Market is for sale.
- Comparison with September. The September edition counted every graded server (6,333, the newest slice of the registry); this one samples a catalogue eight times larger. Direction of change is reliable; a one-point difference is not.
Use this data
Quote any number on this page with a link back to it. Suggested citation: MCP Market, "State of MCP server security, October 2026", mcp.market/research/state-of-mcp-security-october-2026.
Journalists and researchers: the row-level sample behind this edition (CSV, no personal data) and cuts by category, publisher or transport are available on request from hello@mcp.market, usually the same day. We will also re-run any number on the current catalogue.
Earlier editions: all research.