State of MCP Security

Independent safety audit of the Model Context Protocol server ecosystem · by PulseFeed · updated 2026-07-08 · 1 day(s) of data

797
servers audited
538
safe to install
89
avoid (11%)

Headline: how many run code the moment you install them?

10%

80 of 797 MCP servers ship an install/postinstall script — arbitrary code runs on your machine at npm i, before you've even used the tool. Some are legitimate native builds, but each is an unreviewed code-execution vector — and 64 of all audited servers publish no repository to inspect at all. A bad MCP server can read your files, env vars and keys the moment it's connected.

Install-script exposure over time

The trend line appears after a couple of daily crawls. Current: 80

Verdicts

safe
538
caution
165
avoid
89
unknown
5

npm servers get deep signals; remote servers get liveness + HTTPS only.

Top safety flags

unpopular
600
install_script
80
no_repo
64
abandoned
37
no_license
19
unreachable
9
no_target
5
heavy_deps
4

Servers to avoid (sample)

ServerVerdictFlags
ai.alpic.test/test-mcp-serveravoidunreachable
ai.autorfp/mcpavoidunreachable
ai.boolsai/directoryavoidunreachable
ai.boolsai/grepavoidunreachable
ai.buyersense/buyersenseavoidunreachable
ai.clarid/complianceavoidunreachable
ai.com.mcp/hapi-mcpavoidunreachable
ai.com.mcp/skills-searchavoidunreachable
ai.dynamicfeed/dynamic-feedavoidunreachable
agentdbavoidinstall_script
agentic-flowavoidinstall_script
@azure/mcpavoidinstall_script

Building on MCP? Ship it without shipping malware.

We're opening a paid API + CI check: block unsafe MCP servers (install scripts, abandoned, no-provenance) in your pipeline before your team or your agent connects them. Free while in preview — tell us where to send access.

Daily archive

DateAuditedInstall-scriptAvoidAbandoned
2026-07-08797808937

Methodology: PulseFeed discovers MCP servers from the official MCP registry and npm, then audits each independently — install/postinstall scripts (code execution on install), abandonment, provenance, license, repository, download volume, and liveness for remote servers. Verdict = safe / caution / avoid. This report is generated automatically from that data and updates daily. Install scripts are not inherently malicious (native builds use them) but every one is an unreviewed code-execution vector worth checking. Same independent-audit approach as our x402 trust oracle.
Check any server free: GET /mcp/verify?package=<npm-name> · Machine-readable: /mcp-report.json · Live observatory: /mcp · /llms.txt