We pulled every server listing from registry.modelcontextprotocol.io -- the official Model Context Protocol registry maintained by Anthropic -- and ran each one through ClawGuard's security analysis engine. 11,529 servers. 4.7 seconds. Zero LLM calls.
The result: 850 servers (7.4%) flagged with potential security risks. Zero contained malicious patterns in their registry metadata. The MCP ecosystem is healthier than many expected -- but 850 servers still expose capabilities that developers and companies need to understand before deploying them.
Previous studies sampled small subsets. A Queen's University study analyzed 1,899 MCP servers and found 7.2% had potential security issues. Other published scans covered 1,000 or fewer servers. Sampling is useful for statistics, but when the full registry is public and your scanner runs in under 5 seconds, there is no reason to sample. Scan everything.
Our findings independently validate the Queen's University result on 6x the sample size: they found 7.2%, we found 7.4%. That convergence on a much larger dataset increases confidence in both results.
Every server was analyzed using two complementary approaches, both running locally with zero external API calls:
This two-layer approach catches both intentionally malicious servers (Layer 1) and inherently risky servers that are legitimate but demand extra scrutiny before deployment (Layer 2).
All 850 flagged servers were flagged for capability risk -- meaning they declare access to sensitive resources like file systems, databases, or credentials. That does not make them malicious. It makes them servers that require informed deployment decisions.
Of the 850 flagged servers, here is what they claim access to:
File system access tops the list because many MCP servers are built to help AI agents read, write, and manage files. That is their purpose. But an AI agent with unrestricted file system access connected to an untrusted MCP server is a path traversal vulnerability waiting to happen.
Zero malicious patterns is a strong signal. Anthropic's registry review process is filtering out overtly malicious submissions. This is good news for developers who stick to the official registry rather than installing servers from random GitHub repos.
850 servers handling file systems, databases, credentials, and payment processing deserve scrutiny before deployment. The question is not "is this server malicious?" but "what happens if this server is compromised?" A database MCP server with read/write access that gets poisoned through a supply chain attack has the same impact as a deliberately malicious one.
The MCP ecosystem's biggest security challenge is not malware in the registry. It is the blast radius of legitimate servers. When 160 servers declare file system access and 128 handle authentication credentials, the attack surface for prompt injection, tool poisoning, and supply chain attacks is significant -- even if every server author has good intentions.
Article 9 of the EU AI Act requires risk management systems for high-risk AI applications. MCP servers that handle credentials, PII, or financial data connected to autonomous AI agents are firmly in scope. "We didn't know what the server had access to" is not a compliance defense.
Our scan provides the kind of capability mapping that compliance teams need: for each server, what does it access, what is the risk score, and which OWASP categories apply. That is not a nice-to-have. After August 2, it is a requirement.
| Study | Servers Scanned | % Flagged | Method |
|---|---|---|---|
| Queen's University (2025) | 1,899 | 7.2% | LLM-assisted analysis |
| Industry scan (2026) | 1,000 | Not disclosed | Proprietary |
| This scan (ClawGuard) | 11,529 | 7.4% | Regex + capability, no LLM |
The convergence between Queen's University's 7.2% and our 7.4% is notable given the difference in methodology (LLM-assisted vs. deterministic pattern matching) and sample size (1,899 vs. 11,529). Two independent methods reaching near-identical conclusions on overlapping but differently-sized datasets strengthens the finding.
Our scan also has a property that LLM-based approaches cannot guarantee: deterministic reproducibility. Run the same scan tomorrow and you get the same results. No temperature, no prompt variation, no model version drift. The same patterns either match or they don't.
Search, filter, and drill into all 11,529 servers. See risk scores, capability breakdowns, and OWASP mappings for every server in the official MCP Registry.
Interactive Dashboard ClawGuard on GitHub