State of MCP Server Security: A 45-Server Scan

Description and use

A security scan of 45 public MCP servers revealed that 91.1% lack provenance metadata, 86.7% use unpinned remote sources, and 4.4% contain hardcoded credentials. The analysis was performed statically using the sentinel-scan-cli tool.

Problem

Claims about MCP server insecurity were anecdotal; there was a lack of empirical data on supply chain risks such as missing provenance, unpinned dependencies, and hardcoded credentials in public MCP server manifests.

Outcome

The scan found that 91.1% of servers lack provenance metadata, 86.7% have unpinned remote sources (e.g., npx -y without version pin), and 4.4% have hardcoded credentials. No servers were contacted or executed; analysis was purely static on published configs.

Workflow

• Fetch the awesome-mcp-servers.md list and parse entries into candidate records.
• Randomly sample 35 community entries and add 10 official Anthropic reference servers.
• Fetch each project's public README via unauthenticated GET requests.
• Build an mcp.json-style manifest per server, preferring published JSON blocks or tokenizing install one-liners.
• Run sentinel-scan mcp --manifest <file> against all manifests using static text analysis.
• Aggregate results into OWASP-mapped classes to identify risks like unpinned sources and missing provenance.

Evidence

91.1% missing provenance metadata (41/45)

Source

86.7% unpinned remote source (39/45)

Source

4.4% hardcoded credential (2/45)

Source