# State of MCP server security: data, November 2026

The data behind the [State of MCP server security report](https://trustedmcp.io/reports/2026-11). Snapshot: **2026-11-05**.

**Short version:** 36,164 of 55,934 active entries in the official MCP Registry (64.7%) have no package that the OSV advisory database can look up. So a clean result means less than you might think.

**Who made this:** TrustedMCP is run by a small dev shop that builds MCP servers for clients, and this site brings us work. So we have a stake in this topic. That is why the method, the limits and the numbers that make MCP look fine are all here.

## Results

| Check (full registry) | Count | Share |
|---|---|---|
| Registry-listed version has a known advisory | 9 of 19,765 entries | 0.05% |
| Any advisory on record | 84 of 37,746 entries | 0.22% |
| Stale or archived repo | 1,957 of 25,575 repos | 7.7% |
| No security policy | 17,399 of 25,575 repos | 68% |
| No source link | 19,146 of 55,934 entries | 34.2% |
| Plain http on a public host | 0 of 37,722 entries | 0% |

Each check has its own base. `METHOD.md` gives the definition, exclusions and caveat for each.

Also: 3,965 of 29,540 linked GitHub repos don't resolve, and 4,800 entries link to them. CVEs mentioning MCP not matched to a registry entry by repo: 273 of 331, published 2026-07-08 to 2026-11-05. This is not a coverage number: many are in SDKs and apps rather than listed servers.

**Our own 82 hand-graded listings** (picked by us, mostly popular and vendor-backed servers, so not representative of the registry). Grades: A 31, B 27, C 19, D 5. Default auth: yes 55, optional 12, no 15. Transport band: full 58, partial 21, none 3. The grades are our opinion.

## Files

| File | What it is |
|---|---|
| `entries.csv` | 55,934 rows, one per active registry entry |
| `repos.csv` | 25,575 rows, one per reachable GitHub repo |
| `unreachable-repos-by-size.csv` | 3,965 unreachable repos, as totals |
| `editorial.csv` | 82 hand-graded listings, by name |
| `summary.json` | Every check as the report run wrote it |
| `report-page.json` | Other figures on the report page |
| `METHOD.md` | Sources, definitions, hand check, what we changed for this copy |
| `LICENSE` | CC BY 4.0 |

### `entries.csv`

1 = yes, 0 = no, blank = not applicable.

| Column | Meaning |
|---|---|
| `runs_as` | Package types and `remote`, as the entry lists them. Blank = none listed |
| `osv_package_versioned` | Has an npm, PyPI, NuGet or cargo package. 1 = with a version OSV can check, 0 = only a tag such as `latest`, blank = no such package |
| `vulnerable_latest` | An OSV advisory affects the package version in the entry's latest registry record |
| `advisory_any` | Any advisory on record, from OSV or a matched NVD CVE. Blank = nothing to match on |
| `osv_advisories`, `nvd_advisories` | Distinct advisories, with OSV aliases merged |
| `no_public_source` | No repository URL in the registry |
| `has_remote` | Lists a remote endpoint |
| `plaintext_remote` | A remote uses http:// on a public host |
| `localhost_http_remote` | A remote uses http:// on a local host |

### `repos.csv`

| Column | Meaning |
|---|---|
| `entries` | Active registry entries linking to this repo |
| `renamed` | The registry link is an old name that GitHub still redirects |
| `pushed_date` | Date of the last push, to any branch |
| `is_archived` | Archived on GitHub |
| `stale` | Archived, or last push before 2026-05-09 |
| `has_security_policy` | GitHub reports a security policy. Organisation-level policies count |

## What's left out, and why

**No entry, publisher or repo is named here**, except the listings in `editorial.csv`, which are public pages on our site. This report is about the registry, not about individual maintainers.

**Dead repo names are left out**, because a list of them could help someone take over a name. Live repo names are left out for the same reason: subtract them from the public registry and you have the dead ones. Rows are in random order and the files can't be joined, on purpose.

We don't claim this keeps the names secret. Anyone can rebuild them from the public registry and the GitHub API. We just don't hand out the list.

Our cache files and the working notes from the hand check aren't here either, since they hold those names. No file has tokens, emails or other contact details.

## What you can and can't check

**You can re-count from these files:** every result in the table above, the 36,164 not checkable, the 3,965 unreachable repos and the entries linking to them, the entries on stale or policy-less repos, and all the editorial figures. For example:

```python
import csv
rows = list(csv.DictReader(open('entries.csv', encoding='utf-8')))
print(sum(r['osv_package_versioned'] == '' for r in rows))  # 36164
print(sum(r['vulnerable_latest'] == '1' for r in rows))     # 9
```

**You can't check from these files:** any single row against its source, since rows have no names. Nor the top-publisher figure (6,476 entries), the CVE lists, or the hand check. To test those, rebuild the data from the sources below using `METHOD.md`, and [tell us](https://trustedmcp.io/contact) if you get something different. The code that made this is in our private site repo and isn't part of this package.

## Limits

- **This isn't an audit.** It's a signal from public data, from one snapshot. We didn't install or run any server, and we didn't connect to any endpoint.
- **Dependencies:** OSV was asked about each package itself, not what it depends on.
- **Anything outside the official registry** isn't covered: other directories, and servers listed nowhere.
- **Not measured:** authentication across the registry, unpinned versions, broad permissions, and injection or path-traversal rates. `METHOD.md` says why.
- **A 404 doesn't say why.** A deleted repo, a private repo and a renamed repo whose redirect has gone look the same. We can't tell you which is which.
- **A security policy shows that a policy exists,** not that anyone answers it.
- **No source link isn't proof of neglect.** 17,915 of those entries are remote-only, and some are hosted products.
- **An entry count isn't a count of projects.** One repo backs 2,356 entries.
- **Our judgement is in the numbers.** Advisories a reviewer here dismissed as not applying aren't counted, and the hand check was done on the run before this one (`METHOD.md`).
- **The numbers will move.** The registry changes daily. These describe 2026-11-05 only.

## Sources

- [Official MCP Registry](https://registry.modelcontextprotocol.io)
- [OSV](https://osv.dev), including the [GitHub Advisory Database](https://github.com/github/advisory-database) (CC BY 4.0) and the [PyPI Advisory Database](https://github.com/pypa/advisory-database) (CC BY 4.0)
- [NVD](https://nvd.nist.gov). This package uses data from the NVD API but is not endorsed or certified by the NVD.
- [GitHub GraphQL API](https://docs.github.com/en/graphql)

## Licence

Our compilation, counts and grades are under [CC BY 4.0](LICENSE). Credit "TrustedMCP, State of MCP server security, November 2026" and link to the report. The underlying facts come from the sources above, and their own terms still apply to them.

## Corrections

Found a mistake, or dispute something? [Tell us](https://trustedmcp.io/contact) and we'll correct it.