A measured snapshot of the public Model Context Protocol ecosystem · scanned 2026-10-22
Every tool an MCP server advertises runs inside your agent's context — its name, description and JSON schema are read by the model, so a poisoned or injection-laden tool can quietly steer the agent before it ever calls anything. To see how exposed the ecosystem actually is, we took 118 remote servers listed in the official MCP registry and ran each one through our scanner. Here is what we found.
1. Nearly half the registry's remote servers don't answer. 53 of 118 sampled servers (45%) failed to return a tool list — dead hosts, moved endpoints, or auth walls with no public handshake. Before you wire an agent to a registry entry, confirm it is actually live; a surprising share are not.
2. The live servers are clean on static checks — but the surface is large. Across 528 advertised tools on the 65 reachable servers, our static OWASP LLM01/LLM08 checks came back clean — zero tool-poisoning or injection patterns. That is good news: the public ecosystem is not riddled with overt tool-poisoning today. But servers advertise up to 35 tools each (avg 8.1), and every one of those descriptions is attacker-mutable the next time the server updates. Clean today is not clean forever — which is the case for scanning on every connect, not once.
More advertised tools means more text flowing into your model's context — a bigger surface to keep clean.
| Server | Tools advertised |
|---|---|
ad.getle/leads | 35 |
ai.agentboard/agentboard | 35 |
ai.aivikings/registrar | 34 |
academy.apexai/apex-ai-academy | 30 |
ae.brainy/grocery-prices | 26 |
ai.alphabazaar/arena | 24 |
We pulled remote (streamable-http) servers marked current in the official MCP registry, requested each server's tools/list, and ran every advertised tool's name, description and schema through static checks for prompt-injection, tool-poisoning, data-exfiltration and hidden-unicode patterns (OWASP LLM01 & LLM08). The scanner never invokes a tool — it reads only the metadata the server publishes. "Unreachable" means the server did not return a usable tool list at scan time. This is a static analysis of advertised metadata, not a runtime audit, and the numbers are a point-in-time snapshot of the 2026-10-22 sample.
Run the same scan on any MCP server in seconds — free, read-only, no tool ever invoked. Get a live README badge that re-scans every six hours, or gate your CI on the verdict with continuous monitoring.