mcpbeat Sign in

MCP Security

Connecting an MCP server means handing an agent the right to act on your behalf. We handshake with all 35 067 servers in the registry every 15 minutes and read the tool list each one exposes — so the numbers below are measured, not estimated. 17 746 of them answer with no credentials at all, and 4 505 have lost the repository they were built from while still accepting connections.

17 746
answer without a key
83% of remote servers talk to anyone
4 505
lost their source
repository gone from GitHub, server still running
14 413
tool lists read
we asked each server what it can do
265
archived by the author
marked unmaintained, still listed as active

What servers can actually do

Share of the 14 413 servers whose tool list we could read. A tool list is a permission list — once connected, the protocol gives you no way to narrow it.
Run commands the agent can execute something on the host — the widest door of all 3 029 21.1%
Delete things removes files, records or resources, usually without a confirmation step 755 5.3%
Handle credentials touches tokens, roles or permissions 632 4.4%
Write and change creates or edits data, sends messages, uploads files 2 113 14.7%
Read only fetches and searches, changes nothing 14 344 100.0%

Running, but nobody can read the code

These servers answer requests right now, while the GitHub repository they were published from no longer exists. The registry still lists them as active. Connecting one means trusting something you cannot inspect.
ClawLink
by claw-link

MCP server connecting AI agents to 100+ apps (Gmail, Slack, Notion, GitHub) via one-click OAuth.

answering
Terradev
by theoddden

Cross-cloud GPU orchestration CLI.

245 tools answering
by sophymarine

Live data from 27 official national company registries. Unmodified. For KYB and due diligence.

answering
ProductClank
by productclank

Boost posts and launch community growth campaigns from your AI assistant. OAuth, credit-billed.

39 tools answering
by syntheticbrew

Embed an AI chat widget on your website from your coding agent: provision, configure, get snippet.

answering
aikstockdata — Korean Stock Data
by aikstockdata

Korean stocks: median price path after each DART filing type, T+1 closes, earnings. 12 tools, no key

12 tools answering
Gridbert
by gridbert

Austrian energy data: 119 electricity tariffs daily, grid fees, subsidies, bill analysis.

answering
GIA — Governed Intelligence Architecture
by knowledgepa3

Runtime AI governance: decision gates, human approval, hash-chained audit, compliance mapping.

answering
by eidetic-works

Sovereign Agent OS — Persistent Memory, Governance & Compliance for AI Agents.

28 tools answering
hypernatt-terminal
by dialloube-research

Liquidation radar, execution context and Li.Fi swaps for AI agents. 6 MCP tools; x402 payments.

4 tools answering
Courier
by trycourier

Send notifications, manage templates, and configure integrations with Courier.

145 tools answering
Agent^Rider
by ceedot-rock

Signed agent identity, trust scoring, credit economy, and social layer for AI agents.

64 tools answering

Before you connect one

Five checks that take a minute each and are worth more than any checklist of principles.
Read the tool list, not the description

The description is marketing; the tool list is the contract. Every server page here shows the tools we read straight from the server, with the date we read them.

Check the source still exists

4 505 servers in the registry point at repositories that are gone. If you cannot open the code, you are trusting a binary you did not build.

Notice what it does not ask for

A server holding private data should demand a key. 17 746 of them accept anonymous connections — fine for a public API, alarming for anything else.

Give it its own credentials

Not your personal token. A separate account with the narrowest scope that still works means a compromised server costs you one integration, not everything.

Watch it over time

Tools get added after you connect. We keep the history of what each server exposed and when, so a server that quietly grew a delete tool last month is visible.

MCP security — questions

Answers from our own measurements, not from the protocol docs.

Is it safe to connect an MCP server?
It depends entirely on what the server can do, and that varies wildly. Of the 14 413 servers we managed to query, 3 029 expose at least one tool that runs commands on the host and 755 expose something that deletes. The rest only read. The protocol itself gives you no way to limit this after connecting — the tool list is the permission list.
What does “answers without credentials” mean — is that a vulnerability?
Not by itself. 17 746 of 21 428 remote servers complete a handshake with an anonymous client, which usually means they are meant to be public. It matters for a different reason: anyone can enumerate their tools, including us — that is how this page exists. A server holding your private data should be asking who you are, and 5 029 of them do.
Why does a missing repository matter if the server works?
Because you cannot read what you are running. 4 505 servers are answering right now while the GitHub repository they were published from no longer exists — deleted or made private. The registry still lists them as active. There is no way for anyone, us included, to audit what those servers do with the data you send them.
Do Agent Skills carry the same risk?
A skill is instructions, not a running service, so it cannot act on its own. But 1 190 of them tell the agent to run terminal commands, and 9 141 ship their own executable scripts inside the folder. Those scripts run with whatever access your agent has — read the folder before you copy it in. Browse skills with their contents listed →
How do you measure any of this?
We send a real MCP handshake to every remote address in the registry every 15 minutes and ask for the tool list. Tools are grouped by what their names say they do — a rough method, and we say so plainly: “delete_file” counts as deletion without us opening it. Repository status comes from GitHub directly. Everything here is in the public export. Download the raw data →