Data · updated November 13, 2026
MCP Server Security Statistics
What 4,313 automated scans of open-source MCP servers, AI agents and agent skills found, so you know which risks are common before you install.
Key findings
- Vulnerable dependencies are the most common risk. 67.7% of the 4,313 scanned repositories ship at least one dependency with a known vulnerability, and 48.9% include one rated critical (CVSS 9+). For MCP servers alone the figures are 75.7% and 54.7%.
- Confirmed malware was rare. 32 repositories were flagged for signs of malicious code. On manual review, 31 were false positives (mostly security tools that contain malware patterns in order to detect them). One was a real hit: a known-malicious optional dependency (MAL-2023-462) locked in a project's lockfile, low risk in practice. None of the flagged repositories contained malicious code of its own.
- Many tools can act on your machine. 17.3% run shell commands, 11.8% execute dynamically built code and 11.8% reference credential locations such as SSH keys or cloud credentials. That is normal for many tools, and it is why you should limit the access you give them.
- Getting MCP servers to start is hard. Of the 886 MCP servers we tried to start in a clean sandbox, 27.9% completed the protocol handshake. Many need real API keys or extra setup that a sandbox doesn't have, so this measures how easy a server is to run as shipped, not whether it works. The median server that started exposed 17 tools.
Results by type
| Share of scanned repos that… | MCP servers (2,135) | AI agents (1,350) | Agent skills (828) | All (4,313) |
|---|---|---|---|---|
| Ship at least one dependency with a known vulnerability (OSV) | 75.7% | 73.3% | 37.8% | 67.7% |
| …including at least one rated critical (CVSS 9 or higher) | 54.7% | 55.2% | 23.6% | 48.9% |
| Gitleaks flagged a possible committed secret outside docs and tests (not verified; includes test keys) | 27.4% | 36.3% | 15% | 27.8% |
| Run shell commands in production code | 15.9% | 24.1% | 10% | 17.3% |
| Execute dynamically built code (eval, exec, new Function) | 9.1% | 20.1% | 5.1% | 11.8% |
| Reference credential locations (SSH keys, cloud credentials, browser data) | 10.4% | 16.4% | 7.9% | 11.8% |
| Have an npm install-time script (preinstall, postinstall, prepare) | 14% | 10.5% | 5.4% | 11.3% |
| Turn off TLS certificate checks somewhere in code | 6.8% | 7.3% | 3.3% | 6.3% |
| Install or build cleanly in a fresh environment (where attempted) | 77.9% | 73% | 76.3% | 76% |
What this means if you install MCP servers
The likeliest problem with an open-source MCP server is not hidden malware but an outdated dependency with a known hole, plus broad access that you granted. Pin the version you reviewed, update dependencies, use scoped keys, and keep approval prompts on for actions that write, send or delete. Our MCP server security guide walks through each step.
Method
- Sample: the latest finished scan of each live listing on AgenticMart, 4,313 of 5,387 listings. Listings without an open-source licence (1,020) are not scanned, because we only run code its licence allows.
- When: scans ran between November 1, 2026 and November 6, 2026, each at one pinned commit.
- Tools: Semgrep with AgenticMart's open rules, Gitleaks for secrets, OSV-Scanner for dependencies, and an isolated install, boot and network-egress run. How the scan works.
- Counting: a repository counts once per row if it has at least one matching finding. Findings in tests, examples and docs are excluded from the code rows.
- Limits: automated scans miss things and flag things that aren't problems; the secrets figure in particular includes test keys and look-alike strings. Dependency results depend on the lockfiles a repository commits.
Use this data
The aggregate numbers are free to cite under CC BY 4.0. Please credit "AgenticMart" with a link to this page. The raw figures are available as JSON. Questions about the method: contact us.