mcpbeat Sign in

MCP Security

Connecting an MCP server means handing an agent the right to act on your behalf. We handshake with all 58 955 servers in the registry every 15 minutes and read the tool list each one exposes — so the numbers below are measured, not estimated. 32 921 of them answer with no credentials at all, and 7 697 have lost the repository they were built from while still accepting connections.

32 921
answer without a key
83% of remote servers talk to anyone
7 697
lost their source
repository gone from GitHub, server still running
26 059
tool lists read
we asked each server what it can do
433
archived by the author
marked unmaintained, still listed as active

What servers can actually do

Share of the 26 059 servers whose tool list we could read. A tool list is a permission list — once connected, the protocol gives you no way to narrow it.
Run commands the agent can execute something on the host — the widest door of all 3 662 14.1%
Delete things removes files, records or resources, usually without a confirmation step 1 605 6.2%
Handle credentials touches tokens, roles or permissions 1 329 5.1%
Write and change creates or edits data, sends messages, uploads files 4 779 18.4%
Read only fetches and searches, changes nothing 25 930 100.0%

Running, but nobody can read the code

These servers answer requests right now, while the GitHub repository they were published from no longer exists. The registry still lists them as active. Connecting one means trusting something you cannot inspect.
Watermelon UI
by watermelon

Search free React, Tailwind, and shadcn components, blocks, and dashboards; get installable source.

8 tools answering
by livetennisapi

Live tennis scores, players, rankings, odds and win-probability. ATP, WTA, Challenger, ITF, juniors.

25 tools answering
by apple-rag

Apple developer docs and WWDC transcripts with RAG retrieval and Jev relevance ranking.

2 tools answering
Knowl
by dat999zx

Persistent memory for AI agents, for code, research and everyday life. Stale facts retire.

answering
ClawLink
by claw-link

MCP server connecting AI agents to 100+ apps (Gmail, Slack, Notion, GitHub) via one-click OAuth.

answering
Neuronto Agentic Resource Discovery (ARD) Index
by neuronto

Neuronto Agentic Resource Discovery ARD Index. Search every ARD registry + 31,411 verified tools.

4 tools answering
Neuronto ARD Registry: Agentic Resource Discovery (ARD) Index
by neuronto

Agent Resource Discovery (ARD, IETF draft) registry: search every ARD registry + verified MCP tools

4 tools answering
AdLibrarySpy
by psa-team-source

Shopify store and ad intelligence: traffic, best sellers, apps, live Meta ads and weekly breakouts.

answering
Banco MCP
by douglac

Brazilian Open Finance MCP — 30+ banks (Itaú, Nubank, etc.) to Claude/Cursor. Read-only.

19 tools answering
by sophymarine

Live data from 80+ official national company registries. Unmodified. For KYB and due diligence.

answering
Jus MCP
by mcp-dir

Brazilian legal stack in one MCP: lawsuits, court publications, case law, tenders, certificates.

7 tools answering
Conta Azul MCP
by douglac

Conta Azul ERP MCP — sales, customers, finance and NF-e via OAuth 2.0. Read + write, 35 tools.

58 tools answering

Before you connect one

Five checks that take a minute each and are worth more than any checklist of principles.
Read the tool list, not the description

The description is marketing; the tool list is the contract. Every server page here shows the tools we read straight from the server, with the date we read them.

Check the source still exists

7 697 servers in the registry point at repositories that are gone. If you cannot open the code, you are trusting a binary you did not build.

Notice what it does not ask for

A server holding private data should demand a key. 32 921 of them accept anonymous connections — fine for a public API, alarming for anything else.

Give it its own credentials

Not your personal token. A separate account with the narrowest scope that still works means a compromised server costs you one integration, not everything.

Watch it over time

Tools get added after you connect. We keep the history of what each server exposed and when, so a server that quietly grew a delete tool last month is visible.

MCP security — questions

Answers from our own measurements, not from the protocol docs.

Is it safe to connect an MCP server?
It depends entirely on what the server can do, and that varies wildly. Of the 26 059 servers we managed to query, 3 662 expose at least one tool that runs commands on the host and 1 605 expose something that deletes. The rest only read. The protocol itself gives you no way to limit this after connecting — the tool list is the permission list.
What does “answers without credentials” mean — is that a vulnerability?
Not by itself. 32 921 of 39 888 remote servers complete a handshake with an anonymous client, which usually means they are meant to be public. It matters for a different reason: anyone can enumerate their tools, including us — that is how this page exists. A server holding your private data should be asking who you are, and 11 839 of them do.
Why does a missing repository matter if the server works?
Because you cannot read what you are running. 7 697 servers are answering right now while the GitHub repository they were published from no longer exists — deleted or made private. The registry still lists them as active. There is no way for anyone, us included, to audit what those servers do with the data you send them.
Do Agent Skills carry the same risk?
A skill is instructions, not a running service, so it cannot act on its own. But 1 474 of them tell the agent to run terminal commands, and 11 251 ship their own executable scripts inside the folder. Those scripts run with whatever access your agent has — read the folder before you copy it in. Browse skills with their contents listed →
How do you measure any of this?
We send a real MCP handshake to every remote address in the registry every 15 minutes and ask for the tool list. Tools are grouped by what their names say they do — a rough method, and we say so plainly: “delete_file” counts as deletion without us opening it. Repository status comes from GitHub directly. Everything here is in the public export. Download the raw data →