State of MCP Security · 2026-11-09
Snapshot of the MCP server ecosystem as of 2026-11-09 · by PulseFeed · see the live report →
Headline: how many run code the moment you install them?
462 of 6101 MCP servers ship an install/postinstall script — arbitrary code runs on your machine at npm i, before you've even used the tool. Some are legitimate native builds, but each is an unreviewed code-execution vector — and 658 of all audited servers publish no repository to inspect at all. A bad MCP server can read your files, env vars and keys the moment it's connected.
Install-script exposure over time
Verdicts
npm servers get deep signals; remote servers get liveness + HTTPS only.
Top safety flags
Servers to avoid (sample)
| Server | Verdict | Flags |
|---|---|---|
| ai.agenticshelf/graffeo | avoid | unreachable |
| ai.agenticshelf/mcp | avoid | unreachable |
| ai.agenticshelf/puroair | avoid | unreachable |
| ai.alpic.test/test-mcp-server | avoid | unreachable |
| ai.autorfp/mcp | avoid | unreachable |
| ai.baselight/baselight | avoid | unreachable |
| ai.buyersense/buyersense | avoid | unreachable |
| ai.clarid/compliance | avoid | unreachable |
| ai.com.mcp/hapi-mcp | avoid | unreachable |
| ai.com.mcp/skills-search | avoid | unreachable |
| ai.dynamicfeed/dynamic-feed | avoid | unreachable |
| agentdb | avoid | install_script, downloads_unknown |
Daily archive
| Date | Audited | Install-script | Avoid | Abandoned |
|---|---|---|---|---|
| 2026-11-09 | 6101 | 462 | 473 | 186 |
| 2026-11-08 | 6077 | 461 | 472 | 185 |
| 2026-11-07 | 6046 | 462 | 473 | 185 |
| 2026-11-06 | 6016 | 460 | 471 | 185 |
| 2026-11-05 | 5980 | 459 | 470 | 184 |
| 2026-11-04 | 5908 | 458 | 469 | 181 |
| 2026-11-03 | 5842 | 452 | 463 | 179 |
| 2026-11-02 | 5752 | 448 | 459 | 176 |
| 2026-11-01 | 5741 | 449 | 460 | 175 |
| 2026-10-31 | 5734 | 448 | 459 | 175 |
| 2026-10-30 | 5721 | 443 | 454 | 173 |
| 2026-10-29 | 5684 | 440 | 451 | 170 |
| 2026-10-28 | 5615 | 434 | 445 | 170 |
| 2026-10-27 | 5520 | 431 | 442 | 165 |
Methodology: PulseFeed discovers MCP servers from the official MCP registry and npm, then audits each independently — install/postinstall scripts (code execution on install), abandonment, provenance, license, repository, download volume, and liveness for remote servers. Verdict = safe / caution / avoid. This report is generated automatically from that data and updates daily. Install scripts are not inherently malicious (native builds use them) but every one is an unreviewed code-execution vector worth checking. Same independent-audit approach as our x402 trust oracle.
Check any server free: GET /mcp/verify?package=<npm-name> · Machine-readable: /mcp-report.json · Live observatory: /mcp · /llms.txt