Independent Report on MCP Server Reliability and Security Findings
The first independent security and reliability report on MCP servers has been published, analyzing data from 2,181 remote MCP server endpoints. The report covers reliability, security, and maintenance metrics gathered through monitoring of publicly accessible endpoints.
Key Findings from the Analysis
- 52% of remote MCP server endpoints are dead
- 300 servers have zero authentication, meaning any agent can connect
- 51% have wide-open CORS (Cross-Origin Resource Sharing) configurations
- The finance category scores lowest on trust despite handling sensitive data
- Only 42% of servers with GitHub repositories have committed code in the last 30 days
Available Resources
The full report with detailed methodology is available at yellowmcp.com/report. Developers can test their own MCP servers using the tool at yellowmcp.com/test.
📖 Read the full source: r/ClaudeAI
👀 See Also
MCP Server CVE Exposure Mapping and Public API Released
Researchers have mapped CVE exposure across thousands of MCP servers and built a public API for querying dependency vulnerabilities. The API allows searching by repo/name, filtering by severity, and sorting by CVE count or recency.
New Skill Automates OpenClaw Security Hardening on Remote Servers
A community developer has released a skill that helps AI assistants automatically secure OpenClaw installations on remote servers.
mcp-scan: Security scanner for MCP server configurations
mcp-scan checks MCP server configurations for security issues including secrets in config files, known vulnerabilities in packages, suspicious permission patterns, exfiltration vectors, and tool poisoning attacks. It auto-detects configs for Claude Desktop, Cursor, VS Code, Windsurf, and 6 other AI clients.
MCP Package Security Scan Reveals Widespread Destructive Capabilities Without Confirmation
A security scan of 2,386 MCP packages on npm found 63.5% expose destructive operations like file deletion and database drops without requiring human confirmation. The researcher discovered 49% had security issues overall, with 402 critical and 240 high severity vulnerabilities.