What I found scanning the top 500 MCP servers for security

说明与用途

作者构建了一个扫描器评估前500个MCP服务器，发现112个独特的漏洞，其中只有一个服务器（PraisonAI）在当前版本仍然存在漏洞。大多数服务器在安全性上得分很高，但在许可和维护方面存在差距。

问题

MCP servers run code on the client machine and may expose vulnerabilities or change behavior after installation.

结果

The scan found 112 unique advisories across 6 servers, with only one (PraisonAI) still affected by current advisories. Median score 93, mean 92; 477 servers scored 85–100. The process revealed gaps in license visibility and maintenance status for some servers.

工作流

• 1. Scan the official MCP registry for all server entries.
• 2. Filter entries that ship an npm or PyPI package and rank by last-week downloads.
• 3. For the top 500, collect OSV advisories, GitHub maintenance data, repo and license presence, registry metadata stability, and weekly download counts.
• 4. Score each server on a 0–100 scale based on advisories, maintenance, transparency, metadata stability, and adoption.
• 5. Identify servers with current version advisories and highlight them.
• 6. Generate nightly snapshots of registry metadata and diff for changes that affect code or data flow.
• 7. Alert only on changes that alter remote hosts, package identifiers, runtime commands, or required secrets.
• 8. Provide a checklist for users to follow before installing a server: check advisories, inspect command and args, limit secrets, verify public repo and license, confirm maintenance status, monitor remote hosts, and watch for post-install changes.

证据

Across all 500 servers, OSV returned 112 unique advisories. They hit only 6 servers.

来源

The one server still affected is PraisonAI (io.github.MervinPraison/praisonai). OSV lists 104 unique advisories against its package, and 80 of them include the current registry version (2.3.42) in their affected range.

来源

For the 500 servers, the median score is 93 and the mean is 92. 477 land in the "strong" band (85–100), 22 are "good" (70–84), 1 is "fair" (50–69), and none are poor.

来源