MCP Security Signals

Every signal below comes from actually scanning the published source of each Model Context Protocol server with one deterministic engine — 50,796 findings across 11,908 flagged packages, each with a rule id, a severity and a confidence, each linking to its evidence on the server’s page. This is the triage view: review signals, not verdicts. Nothing here is an LLM’s guess — the same input produces the same finding again.

Findings by severity

Counts are individual findings, so one package can appear under several. The engine graded critical at exactly zero across the whole catalog — a measured result, not a gap in coverage — while the long tail is low-severity supply-chain hygiene. The rows above are the shape of the work; the feed further down is the work itself.

Rule families

Every rule id belongs to one of three families. Bars count the servers each family flagged; the number beside each is raw findings, because one family can fire many times inside one package.

• Source code MTC-SRC — What the shipped code does — shell and command execution, dynamic code evaluation, and network sinks read straight out of the published source.
• Supply chain MTC-SUP — How a package is shipped, before a line of it runs — missing source repository, no license, install-time scripts and names that combosquat a popular one.
• MTC-CAP MTC-CAP — a family of deterministic rules
• Toxic flow MTC-FLOW — The lethal trifecta across a server’s tools: untrusted input + sensitive-data read + external egress compose into a data-exfiltration path a prompt-injected model could drive.
• MTC-NET MTC-NET — a family of deterministic rules
• Tool poisoning MTC-INJ — Instructions aimed at the model hidden in a tool’s description or parameters — instruction overrides, concealment (“don’t tell the user”), forced sequencing and credential-path targeting. Read from the tool surface statically extracted from the published source.
• Rug-pull drift MTC-TOFU — Trust-on-first-use: the package’s bytes moved under a version you already trusted. Rare by design, and the signal worth watching.
• Unicode smuggling MTC-UNI — Hidden payloads in tool metadata — Tags-block characters, zero-width joiners, bidi overrides and homoglyphs that a reviewer’s eye cannot see but the model reads.

Most-affected servers

The worst-graded, most-flagged packages in the catalog — where triage starts. Each links to its full scan, where every finding carries its evidence, location and confidence. A grade describes the exact version that was scanned, never the project in general.

Triage feed

The most recently scanned high and critical findings, limited to confirmed and strong confidence — the rows worth reading first. Each is one finding on one server; follow the name for the evidence behind it.

Top firing rules

Ranked by how many servers each rule flagged, not by how alarming it sounds. Titles are the engine’s own — a combosquat rule names the package it shadows, so a title can be specific to one server.

Confidence

This is the honest part. Every finding is deterministic and evidence-backed — never an LLM’s opinion — but not every one is equally certain. 8 findings are confirmed: the engine reproduced the behaviour rather than matching a pattern near it. That is the difference between this and a heuristic code-analysis score.

• confirmed — the engine reproduced the behaviour end-to-end, not merely matched a pattern
• strong — a deterministic rule matched with solid, evidence-backed grounds
• heuristic — a lower-certainty pattern match, flagged for a human to confirm