State of MCP Server Security: A 45-Server Scan

Описание и применение

Исследование безопасности 45 публичных MCP-серверов выявило, что 91,1% не имеют метаданных происхождения, 86,7% используют неподписанные удаленные источники, а 4,4% содержат захардкоженные учетные данные. Анализ проводился статически с помощью инструмента sentinel-scan-cli.

Задача

Claims about MCP server insecurity were anecdotal; there was a lack of empirical data on supply chain risks such as missing provenance, unpinned dependencies, and hardcoded credentials in public MCP server manifests.

Результат

The scan found that 91.1% of servers lack provenance metadata, 86.7% have unpinned remote sources (e.g., npx -y without version pin), and 4.4% have hardcoded credentials. No servers were contacted or executed; analysis was purely static on published configs.

Рабочий процесс

• Fetch the awesome-mcp-servers.md list and parse entries into candidate records.
• Randomly sample 35 community entries and add 10 official Anthropic reference servers.
• Fetch each project's public README via unauthenticated GET requests.
• Build an mcp.json-style manifest per server, preferring published JSON blocks or tokenizing install one-liners.
• Run sentinel-scan mcp --manifest <file> against all manifests using static text analysis.
• Aggregate results into OWASP-mapped classes to identify risks like unpinned sources and missing provenance.

Доказательства

91.1% missing provenance metadata (41/45)

Источник

86.7% unpinned remote source (39/45)

Источник

4.4% hardcoded credential (2/45)

Источник