State of MCP Server Security: A 45-Server Scan

说明与用途

对45个公共MCP服务器的安全扫描显示，91.1%缺少来源元数据，86.7%使用未固定的远程源，4.4%包含硬编码凭据。分析是使用sentinel-scan-cli工具静态进行的。

问题

Claims about MCP server insecurity were anecdotal; there was a lack of empirical data on supply chain risks such as missing provenance, unpinned dependencies, and hardcoded credentials in public MCP server manifests.

结果

The scan found that 91.1% of servers lack provenance metadata, 86.7% have unpinned remote sources (e.g., npx -y without version pin), and 4.4% have hardcoded credentials. No servers were contacted or executed; analysis was purely static on published configs.

工作流

• Fetch the awesome-mcp-servers.md list and parse entries into candidate records.
• Randomly sample 35 community entries and add 10 official Anthropic reference servers.
• Fetch each project's public README via unauthenticated GET requests.
• Build an mcp.json-style manifest per server, preferring published JSON blocks or tokenizing install one-liners.
• Run sentinel-scan mcp --manifest <file> against all manifests using static text analysis.
• Aggregate results into OWASP-mapped classes to identify risks like unpinned sources and missing provenance.

证据

91.1% missing provenance metadata (41/45)

来源

86.7% unpinned remote source (39/45)

来源

4.4% hardcoded credential (2/45)

来源