The State of MCP Security [pdf]

C A N O P I I State of MCP Security 2026 We scanned more than 11,000 published MCP servers. These are the security issues we found. July 2026 · Annual Report · index.canopii.dev CANOPII · State of MCP Security 2026 index.canopii.dev What we found 11,524 servers scored 830 servers graded D or F — including some of the most- starred in the ecosystem 232 servers with a confirmed dangerous code sink — eval, shell injection, unsafe deserialization 184 versions quietly changed their tool definitions after publication — rug pulls in the wild 741 tools served to anonymous callers by endpoints that claim to require auth The failing tail — grade distribution across 11,524 scored servers A · 43.5% B · 45.5% C 3.8D 5.0 F 2.2% One in every fourteen published servers — 830 in total — carries security failures serious enough to grade D or F. CANOPII · State of MCP Security 2026 index.canopii.dev FINDING 01 Popular servers are disproportionately represented among high-risk servers Servers with 1,000+ GitHub stars are over 5× more likely to be high-risk than obscure ones, and their average score (75) is the lowest of any popularity bucket. Stars measure adoption — not scrutiny of what the code actually does. Teams that whitelist "the famous ones" are selecting for risk, not against it. % high-risk by GitHub stars 1000+ ★ 18.7% 100–999 7.0% 10–99 8.9% <10 ★ 3.6% Failing grades among the 15 most-starred infra tooling vendor (×3) 37.4k ★ F agent-orchestration framework 62.4k ★ F marketing-automation suite 72.6k ★ F observability platform 79.5k ★ D web-scraping library 67.6k ★ D Server names withheld in this edition.

6 of the 15 most-starred servers in the registry grade D or F. CANOPII · State of MCP Security 2026 index.canopii.dev FINDING 02 232 servers ship a confirmed dangerous sink These are not theoretical patterns. Static analysis confirmed reachable code paths that evaluate arbitrary code, spawn shell commands from tool input, or deserialize untrusted data — the exact primitives an attacker needs to turn a prompt injection into code execution on the host running the agent. Confirmed code-safety failures, by sink Arbitrary code eval 141 Command injection 69 Unsafe deserialization 42 1,625 more servers show path-traversal patterns whose reachability couldn't be ruled out 952 show potential SSRF — a server that can be steered to fetch internal URLs The worst offenders score as low as 13/100 — several combine command injection and code eval and unsafe deserialization in one package, including servers from established security and infrastructure vendors. CANOPII · State of MCP Security 2026 index.canopii.dev FINDING 03 The supply chain is wide open Most MCP servers would silently inherit whatever their dependencies ship next. Unpinned dependency trees, install-time scripts, and known-vulnerable packages make the ecosystem a soft target for the same supply-chain attacks that hit npm and PyPI every month. 78% of checked servers don't pin their dependencies (8,735 of 11,141) — the next release of any package they use runs unreviewed 1,617 servers ship dependencies with known, published vulnerabilities right now 260 run install scripts — arbitrary code on your machine before the server is ever started 7 packages confirmed as typosquats of legitimate MCP

servers Most common vulnerable dependencies across the ecosystem idna@3.11 268 servers fast-uri@3.1.0 221 pygments@2.19.2 190 pyjwt@2.12.1 169 pydantic-settings@2.13.1 158 ip-address@10.1.0 114 cryptography@46.0.5 112 starlette@1.0.0 99 A JWT library and three crypto libraries in the top vulnerable list — the packages guarding auth are the ones aging worst. CANOPII · State of MCP Security 2026 index.canopii.dev FINDING 04 Rug pulls: the tool you approved isn't the tool that runs A rug pull is when a server quietly changes what its tools do in a later version — after a user or security team has already approved it. Because MCP clients trust the server's live tool definitions, the change takes effect silently, with no re-approval prompt. 184 versions changed their tool definitions after publication Of version pairs we could compare stable · 90.6% changed · 9.4% Roughly 170 distinct servers showed at least one rug pull — spanning finance, auth, messaging, memory, and developer tooling. Several did it more than once. Detected rug pulls include servers handling crypto signing, payments, email, IBAN generation, and enterprise auth — exactly the categories where a silent behavior change hurts most. CANOPII · State of MCP Security 2026 index.canopii.dev FINDING 05 Auth declared, doors left open We probed live remote MCP endpoints. Of 77 servers that declare authentication in their manifest, 24 — nearly one in three — served their full tool list to anonymous callers. That's 741 tools exposed on the top 20 alone: API gateways, LinkedIn automation, health- booking systems, financial data. 31% of auth-declaring endpoints don't actually enforce it Largest anonymous tool exposures API gateway 135 signal-intel platform 86 secrets platform 76 agent memory store 75 accounting autopilot 61 LinkedIn automation 45 Server names withheld in this edition.

An "open" endpoint means anyone on the internet can list — and in many cases call — the same tools your agents use, without a credential. CANOPII · State of MCP Security 2026 index.canopii.dev FINDING 06 MCP-native attacks are already in the wild Beyond classic code flaws, our AI review flagged behaviors specific to the MCP threat model: instructions hidden inside tool descriptions, tools designed to poison the agent's context, and patterns that route your data somewhere it shouldn't go. Servers flagged, per advisory type Sensitive data access 405 Destructive scope 307 Data exfiltration 139 Hidden instructions 130 Tool poisoning 106 Prompt injection 71 130 servers carry hidden instructions in tool descriptions — text meant for your agent, not for you 321 tool-integrity failures on scoring controls: 187 destructive scopes, 134 injection markers CANOPII · State of MCP Security 2026 index.canopii.dev FINDING 07 Basic hygiene is the exception, not the rule Even where there's no active attack, the ecosystem's defaults leave little margin for error: servers run unsandboxed on developer machines, listen on every network interface, and have no channel for reporting a vulnerability when one is found. 81% of servers ship with no sandboxing — full access to the host they run on 1,709 bind to all network interfaces by default — reachable from the local network 86% have no security policy — no way to responsibly report a vulnerability 0 signed releases verified across nearly 11,700 servers checked CANOPII · State of MCP Security 2026 index.canopii.dev C A N O P I I About Canopii Canopii continuously scans the MCP ecosystem and publishes a security score for every server in the public Trust Index — the source of every number in this report, free to browse at index.canopii.dev and updated continuously. For teams running agents in production, we also build an enterprise MCP gateway that governs, attributes, and audits every tool call. Questions about the data, or about putting your agents under the canopy — we'd love to hear from you.

Explore the Trust Index → Get in touch index.canopii.dev · live scores on 11,000+ MCP servers Methodology. Canopii scanned the MCP registry in June 2026 and scored 11,524 servers on their latest version via static analysis, supply-chain checks, live endpoint probes, and AI-assisted review. Percentages are of checked servers per control; 84% of scored servers were verified at ≥80% confidence. Live, per-server data at index.canopii.dev. CANOPII · State of MCP Security 2026 index.canopii.dev