Build my server

Security reports

State of MCP server security reports

A monthly, dated look at the official MCP Registry: what a security scan can check, what it can't, and what to check before you install a server. Each edition keeps its own page, numbers, method and data, so you can cite any of them and compare months.

Read the newest report

  • Newest November 2026 edition ยท Snapshot 5 Nov 2026

    State of MCP server security, November 2026

    We checked all 55,934 entries in the official MCP Registry against public advisory, CVE and GitHub data. A package scanner can check 19,765 of them. Here is what it finds, what it can't see, and what to check before you install a server.

    • 19,765 of 55,934 entries can be checked
    • 33,297 remote-only, no package to scan
    • 9 of 19,765 list a flagged version
    Read the November 2026 report