The State of MCP Security

Key findings

1. Most servers can change things, not just read them. 48% can write or delete files and 63% call internet services. Content from the internet is the main way prompt injection gets in.
2. 28 servers (5%) can run shell commands. Together they get 717,537 downloads a week. A tricked assistant using one of them can do almost anything the user can.
3. 43% need API keys or tokens. Those keys usually sit in plain text in an MCP config file that gets copied, synced and shared.
4. 41% have at least one code pattern worth reviewing, most often commands built from input (149 servers). These are signals to review, not confirmed vulnerabilities.
5. 72 servers (14%) link to no source repository, so the code you install can't be easily compared with any public source.

How much access do they have?

Each server gets one rating based on the most powerful thing it can do.

• Broad access

  5% (28)

  This server can run commands on your computer. An agent that is tricked could use it to do almost anything you can.

• Review before use

  63% (327)

  This server can change things — files, a browser, a database, or paid online services. Limit what it can reach.

• Limited access

  32% (165)

  If an AI agent using this server were tricked, the damage it could do through this server is limited.

What MCP servers can do

Share of the 520 servers with each capability, found in their published code.

• Calls internet services63% (326)
• Reads files57% (298)
• Writes or deletes files48% (248)
• Needs API keys or tokens43% (221)
• Starts other programs24% (124)
• Controls a web browser7% (36)
• Runs shell commands5% (28)
• Queries a database3% (16)

Most common code patterns

Servers with at least one finding of each type. Click a pattern to see what it means and how to fix it.

• Command injection risk29% (149)
• Plaintext HTTP endpoint11% (56)
• External content fed into the prompt without isolation5% (28)
• Unsafe dynamic code execution4% (23)
• Sensitive values written to logs4% (22)
• Unsandboxed browser automation3% (14)
• TLS certificate verification disabled2% (11)
• Unsafe deserialization of untrusted data1% (4)
• SQL query built from unescaped input1% (4)
• Server-side request to a caller-controlled URL0% (1)

Most-downloaded servers that can run commands

Not a list of bad servers — many are excellent tools. These are the ones to run in a container and keep on "approve each call".

What to do about it

• Pin every MCP server to an exact version, instead of running whatever npx -y fetches today.
• Point filesystem servers at one project folder, never your home directory.
• Keep "approve each tool call" on for anything that writes, sends, or runs commands.
• Keep API keys out of the config file. Use environment variables and the narrowest scopes available.
• Run servers that can execute commands in a container with no personal accounts or credentials.

Method

We took the most-downloaded MCP servers published on npm (plus well-known official servers), downloaded each published package as data (never installed or run), and scanned its source with the Agent Verify scanner 2.0.0. Capabilities come from concrete evidence in the code: for example, "runs shell commands" requires a tool or description that executes commands. Code patterns are static-analysis signals to review, not confirmed vulnerabilities, and a server's rating describes how much it could do, not whether its authors are trustworthy. Download counts are npm weekly downloads at the time of the scan (November 2, 2026). Servers change often; each server page shows the version we checked.

Free to cite with a link to this page. Questions or corrections: hello@aiblockchainventures.com