currently verified
8,380 of 71,565 canonical implementations.
Research question: What can retained production evidence establish about the structure, publisher attribution, delivery model, observed authority, and current verification state of the MCP ecosystem at a defined point in time?
AUTHORIdo Abramovitz, MCP Security Research
PUBLICATION2026-08-31 · Version 1.0.0
SNAPSHOT2026-08-31T07:44:52.721Z · mcpsec-state-2026-08-31T074452Z
REVIEW STATUSAutomated technical validation completed. Independent editorial and external peer review have not been completed.
The MCP ecosystem is granting agents consequential authority faster than organizations can establish publisher identity, observe exact-version behavior, and complete independent security verification.
Identity is unresolved at ecosystem scale.
66,986 active canonical identities lack retained evidence verifying an official publisher. This is an attribution gap—not evidence that community software is malicious.
Authority exists before vulnerability evidence.
170,833 current tools have been independently observed across 10,937 implementations. Their permissions determine potential impact even when no flaw is proven.
Remote delivery creates a continuously changing boundary.
4,353 MCPs link to endpoints whose ownership, availability, authentication, and tool behavior can change independently of local packages.
Unknown—not clean—is the dominant security state.
63,185 canonical current versions remain outside completed eligible public verification. Results from the verified cohort cannot be projected onto them.
SECURITY IMPLICATION
Assurance should be evaluated at the level of the composed agent system.
Organizations should establish publisher identity, inventory authority across every enabled MCP, isolate untrusted inputs from action-taking tools, and retain unknown as a first-class evidence state.
BY THE NUMBERS
canonical MCPs
Deduplicated from 71,584 active source listings.
official attribution
4,579 identities with retained first-party evidence.
observed tools
Current inventories observed independently from 10,937 MCPs.
current verification coverage
8,380 exact current versions completed eligible evidence.
THE BOTTOM LINE
93.6% of active canonical identities are community or unresolved. The adoption decision must establish who controls the repository, package namespace, publisher account, and domain.
6.4%official evidence
66,986 identities are not verified as official
Community publishing is essential to the ecosystem and is not a maliciousness label. The risk is decision ambiguity: users may infer endorsement or ownership from a product name that the retained evidence does not establish.
What defenders should do
Resolve identity separately from functionality. Require a defensible chain from product or organization to repository, package namespace, publisher account, and—where applicable—remote domain before issuing credentials.
SOURCE: MCP Security production catalog relationships. “Official” requires retained first-party evidence; classification is independent of vulnerability status.
THE BOTTOM LINE
MCPs span package registries, source repositories, other coordinates, and remote services. Security controls designed for one channel leave material blind spots elsewhere.
23.5%7.6%68.9%
npm16,83723.5%
PyPI5,4087.6%
Source and other49,32068.9%
REMOTE-LINKED4,353canonical identities
INITIALIZED96722.2% of linked
AUTH REQUIRED1,06624.5% of linked
UNHEALTHY3,28675.5% of linked
What defenders should do
Apply one inventory model across packages, source installations, and remote services. For remote MCPs, continuously monitor domain ownership, authentication posture, availability, and tool drift.
SOURCE: Selected canonical distribution relationships and latest bounded remote observations. Availability and authentication outcomes are not vulnerability verdicts.
THE BOTTOM LINE
Within the independently observed cohort, consequential authority is not exceptional: 12.7% expose open-world behavior, 10.1% expose write capability, and 7.6% expose destructive actions. These flags can overlap and must not be summed.
Evidence boundary: the observed cohort covers 10,937 implementations—15.3% of the canonical inventory. It is not a random sample, authority flags can overlap, and these ratios must not be extrapolated to the full ecosystem.
THREAT SCENARIO 01
Cross-MCP context laundering
Untrusted content enters through a read-oriented MCP, becomes agent context, and influences a separate MCP with execution, transmission, or destructive authority.
The cross-MCP control problem
A single server may look tolerable in isolation while becoming consequential in composition. Security policy should evaluate the path from an information source to an action sink across every server enabled in the same agent environment.
| SOURCE AUTHORITY | ACTION SINK | MINIMUM CONTROL |
|---|---|---|
| Untrusted documents, issues, search, or webpages | Shell, cloud, CI/CD, or administrative execution | Isolate retrieved content; require explicit approval before execution. |
| Secrets, repositories, filesystems, or databases | HTTP, messaging, browser, or deployment transmission | Use destination allowlists, scoped credentials, and outbound data controls. |
| Administrative write access | Deletion, overwrite, payment, or irreversible workflow | Require step-up authentication, dry-run support, and auditable confirmation. |
Composition boundary: the catalog establishes authority classes, not customer coexistence. A potential source-to-sink path is a threat model for policy design—not a proven attack or incident.
WHAT DEFENDERS SHOULD DO
- Inventory exact MCP combinations enabled in each agent environment.
- Map data sources, action sinks, credentials, and irreversible operations across server boundaries.
- Block or gate paths where untrusted input can reach high-impact authority without an independent control.
THE BOTTOM LINE
63,185 canonical current versions—88.3% of the inventory—remain outside completed eligible verification. Unknown is the dominant evidence state.
Canonical inventory71,565100.0%
Ever scanned8,44711.8%
Current verified8,38011.7%
THREAT SCENARIO 02
False assurance from incomplete verification
A current version is treated as safe because no public finding is visible, even though 88.3% of the canonical inventory has no completed eligible current verification.
What the completed cohort establishes
The denominator for interpreting current clean and vulnerable classifications.
504 exact current versions completed at least one required public proof flow.
7,876 exact current versions completed the exercised methods without a proven eligible finding.
Interpretation: 6.0% is the finding rate within the completed current verification cohort. It is not an ecosystem prevalence estimate. The cohort is selection-biased, and neither its vulnerable nor clean share can be projected onto the 63,185 unknown implementations.
How to read the classifications
Verified clean means no eligible finding was proven by the exercised methods against one exact version. It does not prove absence of every vulnerability, safe deployment, trustworthy publishing, or safe cross-MCP composition.
Proven vulnerable means at least one finding completed the required exact-version proof flow. It does not automatically establish remote exploitability, organizational exposure, or risk in other releases.
SOURCE: Retained scan history, selected current artifacts, and publishable exact-version proof results. Verified-cohort rates must not be projected onto unknown versions.
Every claim is tied to an evidence level and a frozen release
This report is descriptive ecosystem research. It does not estimate the prevalence of exploitable vulnerabilities outside the completed verification cohort, and it does not infer maliciousness from community publishing or missing evidence.
Catalog relationship
Active source listings resolve into canonical identities, distribution coordinates, repositories, remote endpoints, and publisher attribution.
Protocol observation
A selected exact artifact initializes and exposes a tool inventory observed independently by the scanner.
Security proof
An exact version completes the reproducible proof flow required for a public vulnerability or verified-clean classification.
RESEARCH PROTOCOL
Active catalog relationships
The population begins with 71,584 active listings retained from public source inventories at the snapshot time.
Canonical implementation
Listings are deduplicated into 71,565 implementations using retained identity and distribution relationships. Counts are implementation-level unless stated otherwise.
Positive evidence only
Official attribution requires retained first-party evidence. All other identities remain community or unresolved; that state is not a security verdict.
Selected primary coordinate
npm and PyPI counts describe the selected primary acquisition coordinate. Source and other is the residual, not a claim that no package relationship exists.
Latest independent observation
Authority counts use the latest successful independently observed current tool inventory. Tool annotations guide policy review but do not prove exploitability.
Exact current artifact
Current verification applies only when evidence matches the selected current artifact. Historical results are retained but do not determine current status.
Bounded endpoint observation
Initialization, authentication, and health describe the latest permitted observation. They do not authorize testing protected functionality.
Protected and non-public evidence
Embargoed findings, credentials, private customer inventory, restricted artifacts, and unsupported causal inferences are excluded.
| FIELD | UNIT | OPERATIONAL DEFINITION | DO NOT INFER |
|---|---|---|---|
canonical_mcps | Implementation | Deduplicated active MCP identity at snapshot time. | Unique company, package, or endpoint. |
official_attribution | Implementation | Identity with retained first-party publisher evidence. | Security certification or vulnerability-free status. |
observed_tools | Tool schema | Tools in latest independently observed current inventories. | Tool use, exploitability, or organizational exposure. |
current_versions_verified | Exact version | Selected current artifacts completing eligible evidence. | Coverage of previous or subsequent releases. |
current_versions_clean | Exact version | No eligible finding proven by the exercised methods. | Absence of every vulnerability. |
current_versions_vulnerable | Exact version | At least one finding completed the required public proof flow. | Remote exploitability or customer impact. |
awaiting_current_scan | Implementation | Current state lacks completed eligible verification. | Clean or vulnerable status. |
Frozen release: all figures in this article use snapshot mcpsec-state-2026-08-31T074452Z. Live catalog counts may differ.
Reproducibility: the aggregate dataset contains every numeric input published in this release and the operational definition attached to it.
Known limitation: coverage is not a random sample. Verified-cohort rates must never be projected onto unknown implementations.
Correction policy: substantive corrections require a new version; the v1.0.0 dataset remains immutable.
REVIEW DISCLOSURE
Authored by Ido Abramovitz. Automated technical validation completed. Independent editorial and external peer review have not been completed. Corrections should identify the snapshot ID, field, and proposed evidence.
Authored by Ido Abramovitz. Automated technical validation completed. Independent editorial and external peer review have not been completed. Corrections should identify the snapshot ID, field, and proposed evidence.
RECOMMENDED CITATION
Abramovitz, I. “The MCP Authority–Assurance Gap: A Cross-Sectional Analysis of 71,565 Model Context Protocol Implementations.” MCP Security, version 1.0.0, 2026-08-31. https://catalog.mcpsecurity.cloud/research/state-of-mcp-security-2026
DATASET INTEGRITY
Snapshot: mcpsec-state-2026-08-31T074452Z
SHA-256: 97bab3daa85454c26e8bf5f044c0e10fe538d8fb0b0182032d0b9f456019a519
DOWNLOAD FROZEN DATASET · V1.0.0Abramovitz, I. “The MCP Authority–Assurance Gap: A Cross-Sectional Analysis of 71,565 Model Context Protocol Implementations.” MCP Security, version 1.0.0, 2026-08-31. https://catalog.mcpsecurity.cloud/research/state-of-mcp-security-2026
DATASET INTEGRITY
Snapshot: mcpsec-state-2026-08-31T074452Z
SHA-256: 97bab3daa85454c26e8bf5f044c0e10fe538d8fb0b0182032d0b9f456019a519