229,539 MCP tools audited.
Here is what we found.

Between October 12, 2026, we probed every publicly enumerable MCP server using the protocol's own handshake. No authentication was bypassed. No tool was invoked. We simply read what any network-connected agent can read — and scored the risk surface.

42,163 Servers Registered

26,823 Probed Live

13,089 Open, No Auth

229,539 Tools Exposed

10.95% High-Consequence

Frozen snapshot: 2026-10-12T23:12:00Z · DOI: 10.5281/zenodo.23382871 · Data: GitHub (CC0)

Key Findings

48.8% of probed MCP servers expose their complete tool inventory without authentication. Any agent on the network can enumerate and invoke these tools.
25,143 tools are classified as high-consequence — they accept URL parameters (SSRF risk), execute commands (code injection), handle credentials (secret exposure), or write to external state (tool poisoning).
0.67% of open servers declare a proper open-source license. 99.3% operate without clear legal provenance — a supply-chain risk for any enterprise integrating MCP tools.
1,420 tools on the single highest-density server. 480 servers host 50+ tools each, creating concentrated attack surfaces where one compromise exposes dozens of endpoints.
5 risk categories scored at the parameter level: SSRF, command injection, credential leakage, tool poisoning, dependency rug-pull. Each tool's input_schema is inspected for dangerous parameter patterns.

"This is not a penetration test. No authentication was bypassed, no tool was invoked. We read only what the protocol itself exposes — and that is the point." — MCP Atlas Methodology

Server Risk Rankings

Browse the full grading of 13,083 open MCP servers. Each server is scored across five risk categories and assigned a grade from A (critical risk) to D (minimal).

Rank	Server	Grade	Score	Tools	Category
Rankings data loads from server_tools analysis. Full CSV available in the Data Access section below.

Showing top 10 preview. Download full rankings →

Methodology

Every candidate server was probed using the standard MCP handshake: initialize → notifications/initialized → tools/list. Tool names, descriptions, and full input_schema JSON structures were captured and scored.

Five Risk Categories

Category	Severity	What We Look For
SSRF / Unrestricted Fetch	High	Tools accepting URL parameters or making HTTP requests — potential for internal network probing
Command Injection	Critical	Tools executing shell commands, scripts, or arbitrary code — RCE surface
Credential Leakage	Critical	Tools handling tokens, API keys, passwords, secrets — exposure via logs or responses
Tool Poisoning	High	Tools writing to external state (email, files, messages) — propagation vector for malicious content
Dependency Rug-Pull	Medium	Tools managing packages or supply chain — vulnerability to rug-pull and typosquatting

Scoring

Tool-level scores are computed from pattern matches against name, description, and schema parameters. Server-level scores aggregate all tool scores, then apply amplifiers: high tool count (×1.3–1.6), no GitHub presence (×1.2), no license (×1.1), unclassified category (×1.15). Amplifiers stack multiplicatively.

Read Full Methodology

Data Access

The underlying census data is public. The analysis, rankings, and scoring engine are available in multiple tiers.

Open Data

Free / CC0

Raw server metadata (42,163 records)
Raw tool records (229,827 records)
SHA-256 verified exports
Baseline package via Zenodo DOI
Scoring engine source code

Download on GitHub

Rankings + Report

Free / ODC-BY

Full server risk rankings (CSV)
Grade distribution (A/B/C/D)
Five-category score breakdown
Methodology appendix
Interactive browser (this page)

Request Access

API Access

By request

Real-time risk lookup API
Input: server_id or tool_name
Output: grade, scores, evidence
Webhook: new server alerts
Integration support

Inquire

For Platforms & Enterprises

If you operate an MCP marketplace, AI gateway, or enterprise agent infrastructure, we offer targeted analysis services.

Service	Scope	Engagement
Platform Audit	Score every server on your marketplace. Receive a prioritized remediation list.	By request
Custom Monitoring	Weekly re-scans of your server ecosystem. Delta reports on risk changes.	By request
Compliance Package	Annual report + continuous monitoring + audit evidence record for your security team.	By request
API Integration	Embed real-time risk ratings into your platform's review workflow.	Custom

Discuss Your Use Case

Verification & Provenance

This is an independent measurement by Correctover. It is not endorsed by or affiliated with the MCP project, IETF, W3C, or any standards body. "MCP" is used only to identify the measured protocol.

Artifact	SHA-256	Status
servers.jsonl.gz	30718661...dfa9d8	OK
server_tools.jsonl.gz	2350dc77...5780f	OK

Data license: ODC-BY 1.0 (compilation) · CC BY 4.0 (prose) · CC0 1.0 (raw third-party metadata, not redistributed) · MIT (scripts)
Attribution: "Contains information from MCP Atlas (Guigui Wang / Correctover), made available under the ODC Attribution License (ODC-BY 1.0)."