Live survey304 models · 14 providers · 22,792 auditsAudited grill-with-docs · SAFE →What changedHow we verifyllms.txt

MCP servers · security · Audit version 0.4.1

MCP security: how servers go wrong, and how we audit them

An MCP server runs with your agent's trust. We read 5,190 of them in full. 1,803 are rated BLOCK, and 1,412 expose a tool that deletes, overwrites or runs commands. Every number on this page is counted from those audits.

Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
More
CoCopilotAIGoogle AI Mode
Cite

Cite this page

ModelsAtlas. “MCP security”. Retrieved 12 Nov 2026. https://modelsatlas.com/mcp/security

How MCP servers go wrong

An MCP server is code your agent calls with the access you gave it. It goes wrong in a few ways, and each one shows up in the servers we audited:

  • Tools that do too much. 1,412 servers expose at least one destructive tool. 1,945 declare shell use in their source.
  • Text that steers the agent. 282 servers carry instruction text, in a README or a tool description, that tries to override the agent.
  • Data that leaves. 108 send data to a host they do not declare. 74 use the filesystem, network or shell without saying so in their own description.
  • Unsafe code. 1,034 servers have a high or critical code injection finding, the most common serious class.
  • Secrets and supply chain. 1,374 have a secret found in the source; 3,725 do not pin their dependencies; 553 have no licence.

Verdicts across 5,190 servers

SAFE 2,381CAUTION 1,006BLOCK 1,803

A BLOCK verdict follows from what was found, never from popularity. These are the reasons behind the 1,803 BLOCK verdicts; a server can have more than one.

Reason for BLOCKServers
A critical finding in the source316
Instruction text that tries to override the agent263
Data sent to a host the server does not declare108
High-severity findings only, none of the above1,287

The most common finding classes

Servers with at least one finding in the class

ClassHigh or criticalAny severity
Code injection1,0341,511 (29.1%)
Prompt injection6212,006 (38.7%)
Network egress4972,415 (46.5%)
Hard-coded secrets3601,360 (26.2%)
Filesystem / path3582,943 (56.7%)
Inventory / provenance1393,547 (68.3%)
Obfuscation / stealth911,360 (26.2%)
Privilege escalation / persistence76132 (2.5%)
Supply chain333,268 (63.0%)
Container / deploy411 (0.2%)

Counted from the findings listed on each server's page. Low-severity findings are common and often harmless (a hidden file, a relative path in a test); the high or critical column is the one to read.

What the tools can do

Every declared tool is classed read, write or destructive

1,627 servers only read. 3,158 have no destructive tool, though some of them write. 1,412 expose at least one destructive tool, and 451 of those are rated SAFE: the verdict says the code does what it claims, not that its tools are harmless. 620 build their tool list at runtime, so we cannot read it from the source.

Start with read-only servers or servers with no destructive tools if you want least privilege.

How we audit an MCP server

The source is read in full at a named commit

LayerWhat we checkResults across 5,190 servers
L0 ProvenanceWho owns the repository, its licence, activity and archived status, and whether the package matches the source.PASS 4,154 WARN 846 FAIL 190
L1 Source scanFilesystem, network and shell use, hard-coded secrets and unpinned dependencies.PASS 2,356 WARN 1,143 FAIL 1,621 NA 70
L2 InstructionsPrompt-injection patterns and authority framing in the skill, the README and tool descriptions.PASS 4,473 WARN 93 FAIL 624
L3 InventoryWhich tools an MCP server exposes, each classed read, write or destructive.PASS 3,514 WARN 1,676
L4 SandboxRuns the package isolated and records what it actually touches.SKIPPED 5,190

Each finding names the rule that fired, the file and the line, with the excerpt. A critical finding, instruction text that tries to override the agent, data sent to an undeclared host, or high-severity findings in the source lead to BLOCK. Medium findings, high findings that stop short of a block, or broad permissions such as shell access or destructive tools lead to CAUTION. The sandbox layer (L4) is not running yet, so no server has grade A. The full method, including how to check a result yourself, is on the methodology page.

Before you connect a server

  1. Read the verdict and the findings.

    Every server page shows the verdict, the grade and each finding with its file and line.

  2. Count the destructive tools.

    Give an agent the least it needs. A read-only server cannot change anything through its tools.

  3. Pin the version.

    The connect commands on our pages pin the package version recorded in the source we read.

  4. Narrow the credentials.

    A remote server sees whatever you send it, and we can only audit the source, not a hosted deployment.

Questions

Is MCP safe?
The protocol is a way to hand an agent tools; whether that is safe depends on the server. Of 5,190 MCP servers we audited, 2,381 are SAFE (45.9%), 1,006 CAUTION and 1,803 BLOCK (34.7%). Read a server's verdict and findings before you connect it.
What are the most common MCP security problems?
Counted by servers with a high or critical finding: code injection (1,034), prompt injection (621), network egress (497). Separately, 1,412 servers expose at least one destructive tool, one that deletes, overwrites or runs commands.
Can a SAFE MCP server still delete my data?
Yes. SAFE means the source does what the server says it does, not that its tools are harmless. 451 SAFE servers expose a destructive tool. If you only need to read, start with a read-only server.
How do you audit an MCP server?
We read the source at a named commit through 5 layers: provenance, a source scan, instruction checks, a tool inventory and a sandbox run (not running yet). Every finding names the rule, the file and the line. The full method is on the methodology page.

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.