MCP Security › Intelligence › Ecosystem risk analysis
Export CSVOpen investigation

Ecosystem risk analysis

Current evidence, remote exposure, and security-verification posture

Data current
FILTERS
Population: All canonical MCPs ⌄
All canonical MCPs71,565Remote-linked MCPs5,032Current verified8,402Proven vulnerable508Current unknown63,163
Version: Current selected ↗Evidence: Public eligible ↗Reset
SELECTED POPULATION71,565All canonical MCPs
CURRENT VERIFIED8,40211.7% coverage
PROVEN VULNERABLE5086% of verified
CURRENT UNKNOWN63,163Not classified as clean
REMOTE-LINKED5,03288.3% observed
Risk concentration matrixLive signal by evidence domain
MatrixCurrent⋯
DOMAINSTABLEGUARDEDHIGHCRITICALVALUE
Current verificationCanonical inventory11.7%8,402 verified
Proven vulnerabilityVerified current versions6%508 vulnerable
Remote observationRemote-linked MCPs88.3%4,445 observed
Unhealthy remote outcomeRemote-linked MCPs56.8%2,860 unhealthy
Authentication requiredRemote-linked MCPs28.6%1,439 endpoints
Policy blockedRemote-linked MCPs22.6%1,135 endpoints
StableGuardedHighCritical
Population coverageCounts against relevant live population
Absolute↗
Canonical inventory
71,565
Current unknown
63,163
Remote observed
4,445
Remote unhealthy
2,860
Cross-MCP path libraryPotential composition, not exploit proof
3 rules
HIGHData → egressFiles, secrets, source → network or messagingInspect →
CRITICALSession → egressBrowser session material → external destinationInspect →
HIGHWeb → executionUntrusted content → shell or code executionInspect →
INVESTIGATION CANVAS

Ecosystem investigation

Search the live ledger to build an entity-level relationship graph.

RELATIONSHIP GRAPH · 6 ENTITIESSelect an entity to inspect it
distributiondistributioninfrastructureevidencefindingCANONICAL INVENTORY71,565NPM ECOSYSTEM16,865PYPI ECOSYSTEM5,411REMOTE MCPS5,032CURRENT EVIDENCE8,402PROVEN FINDINGS508
WHAT WE OBSERVE71,565 canonical implementations connect package, remote, and exact-version evidence records.
WHY IT MATTERSRelationship context turns inventory counts into decisions about identity, exposure, and evidence.
NEXT ACTIONSearch for a production MCP, inspect its graph, then pin it for comparison.
PINNED COMPARISON
No records pinned yet
Open ecosystem analytics and time-series evidence
TIME-SERIES INTELLIGENCE

Ecosystem change and early-warning signals

Daily event transitions retained in the production ledger · 2026-06-11 to 2026-09-08

SIGNALWINDOW TOTALDAILY EVENT VELOCITYCHANGE
Version observationPackage or source versions first observed
9,23090-day events
2026-08-09 · 20 events · open related records2026-08-11 · 4 events · open related records2026-08-13 · 8,294 events · open related records2026-08-14 · 188 events · open related records2026-08-15 · 12 events · open related records2026-08-16 · 8 events · open related records2026-08-17 · 19 events · open related records2026-08-18 · 28 events · open related records2026-08-19 · 26 events · open related records2026-08-20 · 25 events · open related records2026-08-21 · 31 events · open related records2026-08-22 · 24 events · open related records2026-08-23 · 29 events · open related records2026-08-24 · 41 events · open related records2026-08-25 · 110 events · open related records2026-08-26 · 37 events · open related records2026-08-27 · 29 events · open related records2026-08-28 · 25 events · open related records2026-08-29 · 22 events · open related records2026-08-30 · 67 events · open related records2026-08-31 · 28 events · open related records2026-09-01 · 35 events · open related records2026-09-02 · 37 events · open related records2026-09-03 · 34 events · open related records2026-09-04 · 49 events · open related records2026-09-05 · 8 events · open related records
+45950%recent vs priorPeak 8,294 · 08-13
Completed verificationSuccessful exact-version evidence runs
17890-day events
2026-08-15 · 25 events · open related records2026-08-16 · 16 events · open related records2026-08-17 · 9 events · open related records2026-08-18 · 6 events · open related records2026-08-19 · 10 events · open related records2026-08-20 · 29 events · open related records2026-08-21 · 24 events · open related records2026-08-22 · 11 events · open related records2026-08-23 · 1 events · open related records2026-08-24 · 2 events · open related records2026-08-25 · 23 events · open related records2026-08-26 · 3 events · open related records2026-08-27 · 3 events · open related records2026-08-31 · 5 events · open related records2026-09-01 · 5 events · open related records2026-09-02 · 2 events · open related records2026-09-03 · 1 events · open related records2026-09-04 · 3 events · open related records
+100%recent vs priorPeak 29 · 08-20
Resolved findingsProven → clean exact-version transition
090-day events
0%recent vs priorPeak 0 · 06-11
Evidence contract: points are recorded events, not reconstructed snapshots. A resolved finding requires a proven→clean transition on the same exact version. Click a spike to inspect related current records.
COHORT INTELLIGENCE EXPLORER

Distribution cohorts

Where is the canonical MCP inventory concentrated?

Normalized against the displayed live denominator. Select any cohort, segment, or row to open its underlying catalog records.

Let’s talk about MCP security.

Share your details and our security team will contact you.