MCP Security Observatory

What was examined

Known repositories
23,157

collapsed from the public registry
Selected
2,000

2,000 sampled
Scanned
1,673

7.2% of known repositories
Skipped
327

not provably a server
Failed
0

unreachable or over caps

Scanned on 2026-10-04T09:46:20Z. Sample drawn by ordering every repository by sha256("20260923:<server>") and taking the first 2,000, so the same set can be regenerated.

What was found

Findings
916

across 1,673 servers scanned
Published
171

111 distinct decisions
Withheld
745

high and critical, none disclosed
Servers affected
99

in the published set

How often is this right? Not yet measured. 566 findings have been drawn at random from this output and frozen, and 116 are queued for a person to label; per-rule precision and recall will be published here with the threshold they were measured at, and the labelled set will ship as an open benchmark. Until then, treat every finding below as a candidate rather than a confirmed problem.

171 published (19%)
745 withheld, none disclosed (81%)

745 of 916 findings are not shown. Every high and critical finding is withheld, so the table below is the least severe part of what was found and is not a picture of the ecosystem’s worst problems. No maintainer has been notified yet. Only findings a person has verified are reported, privately; each finding’s 90-day window opens only when a notice naming it is recorded, and so nothing above medium severity has ever been published. The gate failing closed is the intended direction. Maintainer opt-out is honoured unconditionally.

By rule - published

Found is every finding the rule produced. Published is what cleared the disclosure gate. A rule can find hundreds and publish none, which is what four of these five do.
Rule	Found	Published	Withheld	Servers
Characters hidden from human review `UNICODE-CONCEAL` · every language	91	0	91	0
Tool input reaching a command interpreter `SHELL-EXEC-UNSAFE` · TypeScript and JavaScript	129	0	129	0
Tool input reaching the filesystem unchecked `PATH-TRAVERSAL` · TypeScript and JavaScript	143	0	143	0
Instructions planted in tool metadata `TOOL-DESC-INJECTION` · TypeScript and JavaScript	382	0	382	0
Server reach wider than its tools require `SCOPE-OVERBROAD` · TypeScript and JavaScript	171	171	0	99

A rule showing zero has published nothing, not found nothing: four of the five emit above medium severity and are withheld in full by the disclosure gate.

Language coverage

Every aggregate figure on this page is bounded by this table. A percentage derived from TypeScript is never presented as an ecosystem-wide one.
Rule	Detects	Examines
`UNICODE-CONCEAL`	Characters hidden from human review	every language
`SHELL-EXEC-UNSAFE`	Tool input reaching a command interpreter	TypeScript and JavaScript
`PATH-TRAVERSAL`	Tool input reaching the filesystem unchecked	TypeScript and JavaScript
`TOOL-DESC-INJECTION`	Instructions planted in tool metadata	TypeScript and JavaScript
`SCOPE-OVERBROAD`	Server reach wider than its tools require	TypeScript and JavaScript

Most repeated decisions - published

One misconfiguration set on many response paths. Counting the rows instead of the decisions would overstate these servers roughly twofold.
Server	What the rule reported	Lines
`io.github.docracy1/runwayleft`	accepts any origin ('*')	9
`com.universalagentforum/forum`	accepts any origin ('*')	6
`io.github.vuluu2k/webcake-storefront-mcp`	accepts any origin ("*")	6
`live.pulsarsignal/pulsar`	accepts any origin ('*')	6
`com.onkernel/kernel-mcp-server`	accepts any origin ("*")	5
`io.github.BrightbeamAI/chap`	accepts any origin (*)	5
`io.github.meltingpixelsai/harvey-budget`	accepts any origin ("*")	4
`io.github.meltingpixelsai/harvey-verify`	accepts any origin ("*")	4
`com.expense-budget-tracker/expense-budget-tracker`	listens on 0.0.0.0	3
`io.github.atul-fusionpact/fusionpact-vectordb`	accepts any origin (*)	3