mcpbeat

MCP Security

Connecting an MCP server means handing an agent the right to act on your behalf. We handshake with all 20 107 servers in the registry every 15 minutes and read the tool list each one exposes — so the numbers below are measured, not estimated. 7 920 of them answer with no credentials at all, and 2 840 have lost the repository they were built from while still accepting connections.

7 920
answer without a key
77% of remote servers talk to anyone
2 840
lost their source
repository gone from GitHub, server still running
5 643
tool lists read
we asked each server what it can do
157
archived by the author
marked unmaintained, still listed as active

What servers can actually do

Share of the 5 643 servers whose tool list we could read. A tool list is a permission list — once connected, the protocol gives you no way to narrow it.
Run commands the agent can execute something on the host — the widest door of all 299 5.3%
Delete things removes files, records or resources, usually without a confirmation step 356 6.3%
Handle credentials touches tokens, roles or permissions 337 6.0%
Write and change creates or edits data, sends messages, uploads files 1 057 18.8%
Read only fetches and searches, changes nothing 5 610 100.0%

Running, but nobody can read the code

These servers answer requests right now, while the GitHub repository they were published from no longer exists. The registry still lists them as active. Connecting one means trusting something you cannot inspect.
com.mux/mcp

The official MCP Server for the Mux API

2 tools answering
io.github.getgapup/mcp-knowledge

100+ MCP tools for AI agents: content metadata, trade intelligence, business-expertise analysis.

271 tools answering
io.github.conquext/neuron

AI-powered WhatsApp chatbot platform with 196 tools for bots, campaigns, and contacts.

246 tools answering
GPT55 Model Gateway
xyz.558686.gpt55/token-gateway

Remote MCP gateway for GPT-5.6 Luna, Soul, Terra, and x402-paid agent tools with no API key.

216 tools answering
SpaceMolt
io.github.statico-alt/spacemolt

MMO game for AI agents: mine, trade, craft, explore, and battle in a galaxy of ~500 systems

212 tools answering
Crank Protocol
ing.crank/crank

Non-custodial DeFi tools for AI agents on Solana: swaps, perps, lending, staking, equities.

167 tools answering
IA-QA — 130+ QA & Dev Tools for AI Agents
io.github.JcJamet/ia-qa-toolbox

130+ QA & dev tools for AI agents: prompt injection, RAG testing, VLM eval, guardrails. Free.

150 tools answering
Algenta MCP Server
io.github.thyn-ai/algenta

Governed data discovery, exact queries, decisions, simulations, and runtime utilities over MCP.

140 tools answering
Delx Commerce — Intent-First APIs for Agents
io.github.davidmosiah/delx-mcp-a2a

64 pay-per-result MCP/x402 APIs for media, agents, web, data, trust and location.

133 tools answering
Ready APIs
com.readyapis/api

135 MCP tools: geo, email, phone, company, DNS, FX, equities, weather, tax, econ, intel — one key.

129 tools answering
Meta Council
com.meta-council/decision-intelligence

Multi-expert decision intelligence with transparent synthesis and auditable workflows.

94 tools answering
TunnelMind Data API
ai.tunnelmind/data

Tracker / Sigil / Cross-lens — every TunnelMind Data API operation as one MCP surface.

91 tools answering

Before you connect one

Five checks that take a minute each and are worth more than any checklist of principles.
Read the tool list, not the description

The description is marketing; the tool list is the contract. Every server page here shows the tools we read straight from the server, with the date we read them.

Check the source still exists

2 840 servers in the registry point at repositories that are gone. If you cannot open the code, you are trusting a binary you did not build.

Notice what it does not ask for

A server holding private data should demand a key. 7 920 of them accept anonymous connections — fine for a public API, alarming for anything else.

Give it its own credentials

Not your personal token. A separate account with the narrowest scope that still works means a compromised server costs you one integration, not everything.

Watch it over time

Tools get added after you connect. We keep the history of what each server exposed and when, so a server that quietly grew a delete tool last month is visible.

MCP security — questions

Answers from our own measurements, not from the protocol docs.

Is it safe to connect an MCP server?
It depends entirely on what the server can do, and that varies wildly. Of the 5 643 servers we managed to query, 299 expose at least one tool that runs commands on the host and 356 expose something that deletes. The rest only read. The protocol itself gives you no way to limit this after connecting — the tool list is the permission list.
What does “answers without credentials” mean — is that a vulnerability?
Not by itself. 7 920 of 10 229 remote servers complete a handshake with an anonymous client, which usually means they are meant to be public. It matters for a different reason: anyone can enumerate their tools, including us — that is how this page exists. A server holding your private data should be asking for a key, and 2 767 of them do.
Why does a missing repository matter if the server works?
Because you cannot read what you are running. 2 840 servers are answering right now while the GitHub repository they were published from no longer exists — deleted or made private. The registry still lists them as active. There is no way for anyone, us included, to audit what those servers do with the data you send them.
Do Agent Skills carry the same risk?
A skill is instructions, not a running service, so it cannot act on its own. But 1 021 of them tell the agent to run terminal commands, and 8 405 ship their own executable scripts inside the folder. Those scripts run with whatever access your agent has — read the folder before you copy it in. Browse skills with their contents listed →
How do you measure any of this?
We send a real MCP handshake to every remote address in the registry every 15 minutes and ask for the tool list. Tools are grouped by what their names say they do — a rough method, and we say so plainly: “delete_file” counts as deletion without us opening it. Repository status comes from GitHub directly. Everything here is in the public export. Download the raw data →