Independent safety audit of the MCP server ecosystem · by PulseFeed
Thousands of MCP servers ship with almost no vetting — and a bad one can run arbitrary code on your machine or exfiltrate data. Before you connect your AI agent to an MCP server, check it. We audit maintenance, install-script risk, provenance, abandonment and liveness.
npm servers get deep signals; remote servers get liveness + HTTPS only (can't fully verify a black-box remote).
install_script = arbitrary code on npm i; abandoned = stale; unreachable = dead remote.
| Server | Type | npm dl/wk | Trust |
|---|---|---|---|
| @modelcontextprotocol/sdk | npm | 64,994,424 | 100 |
| ai | npm | 31,177,103 | 100 |
| @ai-sdk/mcp | npm | 5,178,734 | 100 |
| @storybook/mcp | npm | 2,324,360 | 100 |
| @storybook/addon-mcp | npm | 2,528,261 | 100 |
| mcporter | npm | 450,946 | 100 |
| @assistant-ui/react | npm | 2,034,635 | 100 |
| mcp-handler | npm | 1,387,856 | 100 |
| @copilotkit/aimock | npm | 486,080 | 100 |
| fallow | npm | 1,422,346 | 100 |
| mcp-remote | npm | 663,737 | 100 |
| @langchain/mcp-adapters | npm | 287,805 | 100 |
| add-mcp | npm | 201,186 | 100 |
| eve | npm | 1,326,613 | 100 |
| @modelcontextprotocol/server | npm | 11,702,082 | 100 |
GET /mcp/verify?package=<npm-name> — free. Returns a safety verdict, score and flags (install scripts, abandonment, provenance, license, repo).Methodology: PulseFeed discovers servers from the official MCP registry, audits each via npm metadata (install scripts, provenance, license, downloads, freshness) and liveness for remotes. Same independent-audit approach as our x402 trust oracle. Machine-readable: /mcp.json. Updated daily.