Every signal below comes from actually scanning the published source of each Model Context Protocol server with one deterministic engine — 57,243 findings across 19,190 flagged packages, each with a rule id, a severity and a confidence, each linking to its evidence on the server’s page. This is the triage view: review signals, not verdicts. Nothing here is an LLM’s guess — the same input produces the same finding again.
Counts are individual findings, so one package can appear under several. The engine graded critical at exactly zero across the whole catalog — a measured result, not a gap in coverage — while the long tail is low-severity supply-chain hygiene. The rows above are the shape of the work; the feed further down is the work itself.
Every rule id belongs to one of three families. Bars count the servers each family flagged; the number beside each is raw findings, because one family can fire many times inside one package.
Bar length is servers affected; the note is raw findings.
MTC-SRC — What the shipped code does — shell and command execution, dynamic code evaluation, and network sinks read straight out of the published source.MTC-SUP — How a package is shipped, before a line of it runs — missing source repository, no license, install-time scripts and names that combosquat a popular one.MTC-TOFU — Trust-on-first-use: the package’s bytes moved under a version you already trusted. Rare by design, and the signal worth watching.The worst-graded, most-flagged packages in the catalog — where triage starts. Each links to its full scan, where every finding carries its evidence, location and confidence. A grade describes the exact version that was scanned, never the project in general.
| Server | Grade | Findings | High |
|---|---|---|---|
| Judges | F | 66 | 37 |
| Security | F | 53 | 36 |
| Vmlx | F | 35 | 33 |
| Brave Real Browser | F | 43 | 32 |
| Angr Api | F | 34 | 32 |
| Codemore | F | 37 | 30 |
| Kbot | F | 52 | 28 |
| Pytest | F | 35 | 28 |
| Imas Codex | F | 33 | 28 |
| Yt Dlp | F | 30 | 28 |
| Guardianshield | F | 39 | 27 |
| Diffgate Review | F | 36 | 27 |
The most recently scanned high and critical findings, limited to confirmed and strong confidence — the rows worth reading first. Each is one finding on one server; follow the name for the evidence behind it.
MTC-SRC-001
Dynamic code execution in server code (mindsdb/api/executor/utilities/mysql_to_duckdb_functions.py)
MTC-SRC-001
Dynamic code execution in server code (mindsdb/integrations/handlers/duckdb_faiss_handler/duckdb_faiss_table.py)
MTC-SRC-001
Dynamic code execution in server code (mindsdb/integrations/handlers/pgvector_handler/pgvector_handler.py)
MTC-SRC-002
Shell/command execution in server code (mindsdb/integrations/handlers/openai_handler/openai_handler.py)
MTC-SRC-002
Shell/command execution in server code (mindsdb/integrations/utilities/install.py)
MTC-SRC-006
Reads a sensitive credential path or dumps the environment (awslabs/aws_api_mcp_server/core/common/errors.py)
MTC-SRC-002
Shell/command execution in server code (scripts/ensure-sandbox-browser-image.mjs)
MTC-SRC-001
Dynamic code execution in server code (artsleuth/benchmarks/wikiart.py)
Ranked by how many servers each rule flagged, not by how alarming it sounds. Titles are the engine’s own — a combosquat rule names the package it shadows, so a title can be specific to one server.
Bar length is servers affected; colour is the rule’s severity.
| Rule | What it catches | Servers |
|---|---|---|
MTC-SUP-011 low |
Package has no source repository | 11,293 |
MTC-SRC-002 high |
Shell/command execution in server code (__tests__/tool-integration.test.ts) | 8,662 |
MTC-SUP-012 info |
Package has no license | 4,857 |
MTC-SRC-003 medium |
Hardcoded egress to an external endpoint (youtube_transcript_api/_errors.py) | 1,726 |
MTC-SRC-001 high |
Dynamic code execution in server code (__main__.py) | 1,363 |
MTC-SRC-009 medium |
Untrusted input concatenated into a command sink (webasyst-mcp.js) | 1,250 |
MTC-SRC-005 medium |
Dynamic module load from a non-literal (__init__.py) | 1,204 |
MTC-SUP-010 medium |
Package runs install-time scripts (preinstall, postinstall) | 1,135 |
MTC-SUP-006 medium |
Possible combosquat of mcp | 976 |
MTC-SRC-006 high |
Reads a sensitive credential path or dumps the environment (__main__.py) | 772 |
This is the honest part. Every finding is deterministic and evidence-backed — never an LLM’s opinion — but not every one is equally certain. 449 findings are confirmed: the engine reproduced the behaviour rather than matching a pattern near it. That is the difference between this and a heuristic code-analysis score.
Counts are individual findings; the note is each level’s share.
Scanning runs on a queue, not on page load. These figures are recomputed at most once a minute from the stored scans, and this snapshot was built 2026-07-23 09:27 UTC. Re-check any package yourself with the free API or the CLI — same input, same finding, no account needed.