I Scanned 50 Popular MCP Servers. Here's What I Found.

Real audit data from the 50 most-starred MCP servers on GitHub. April 2026.

I used audit.pyfio.com to scan the 50 most-starred MCP servers on GitHub. The scanner checks five categories: permissions and scope, code safety, supply chain risk, transparency, and maintenance signals. Each server gets a weighted score from 0 to 100.

The short version: most popular MCP servers score well. The average was 90.5 out of 100. But the most interesting finding wasn't about scores at all.

The real story: 43 of 50 servers can't be statically analyzed

The most common finding wasn't a security bug. It was "no source files found for analysis." 43 of 50 servers had no analyzable JavaScript or TypeScript source code. They're written in Go, Rust, Python, or C#. The code safety scores for those servers are incomplete because the scanner currently focuses on JS/TS analysis.

This matters. Code safety averaged 81.6, the lowest of all five categories. But that number is misleading. It's low partly because the scanner can't fully evaluate most of these repos yet. The real code safety picture for the MCP ecosystem is still unknown.

30 of 50 servers also had no package.json, which means the supply chain analysis (dependency checking, lockfile verification) was also limited for those repos.

The one critical finding: eval() in browser-tools-mcp

AgentDeskAI/browser-tools-mcp was the only server with a critical-severity finding. Score: 81, the lowest in the dataset. The scanner found an eval() call in chrome-extension/devtools.js. That's a function that executes arbitrary code, and it showed up in a Chrome extension that has direct browser access.

The same server also had potential SSRF vulnerabilities in three files (devtools.js, background.js, panel.js) where HTTP requests appeared to use user-controlled URLs, plus 10 network calls total. Its code safety score was 50 out of 100.

To be clear: this doesn't mean the server is malicious. The eval() might be intentional for the Chrome extension's functionality. But it's the kind of thing you want to know about before you install it. That's the point of the audit.

The best servers

upstash/context7 and firecrawl/firecrawl-mcp-server both scored 99 out of 100. Perfect 100 in permissions, code safety, supply chain, and transparency. The only ding was maintenance (high open issue counts: 132 and 96, respectively). That's more a sign of popularity than neglect.

Context7 is the most-starred server in the dataset at 51,892 stars. It had just 2 production dependencies (@inquirer/core, @inquirer/type). Firecrawl had 5 production dependencies, all well-known packages. Clean repos, proper licenses, minimal attack surface.

The bottom five

The five lowest-scoring servers:

1. AgentDeskAI/browser-tools-mcp (81): Critical eval() usage, potential SSRF in 3 files, network access
2. activepieces/activepieces (83): 2 high-severity findings
3. google-gemini/gemini-cli (83): Requests filesystem and network access, 1 high finding. Google's own CLI. 100k+ stars.
4. BrowserMCP/mcp (85): 1 high-severity finding
5. FunnyWolf/Viper (86): 2 high-severity findings. This is a penetration testing framework, so elevated permissions are expected.

Notice that Google's gemini-cli is in the bottom five. A big name doesn't guarantee a clean audit. Also worth noting that Viper is a pentesting tool by design, so its findings make sense in context.

Category breakdown

The five audit categories, averaged across all 50 servers:

• Permissions & Scope (30% weight): 98.7. Most servers don't request excessive permissions. Good.
• Transparency (15%): 95.1. Almost all had LICENSE files and decent documentation. 11 servers were missing permissions or security documentation.
• Maintenance (10%): 93.0. Popular repos tend to be actively maintained. High issue counts were common but not penalized heavily.
• Supply Chain (20%): 84.0. 5 servers had no lockfile. 3 had suspicious dependency names. 3 had install scripts detected.
• Code Safety (25%): 81.6. The weakest category, mostly because 43 servers couldn't be fully analyzed.

Score distribution

No server scored below 80. The distribution:

• 90-99: 36 servers (72%)
• 80-89: 14 servers (28%)
• Below 80: 0 servers

Popular, well-starred repos cluster at the top. That's expected. These projects have active maintainers and community oversight. The more interesting question is what the distribution looks like for less popular servers, the ones with 50 stars that someone found in a blog post and added to their MCP config. I haven't scanned those yet.

All 50 results

What this means for MCP security

The MCP ecosystem is in decent shape if you stick to popular servers. The top 50 by stars are generally well-maintained, properly licensed, and don't request excessive permissions. But there are a few things that stood out.

First, static analysis tooling for MCP servers is still early. Most servers aren't written in JavaScript. A scanner that only reads JS/TS misses most of the ecosystem. I'm expanding language support, but this is a real gap right now.

Second, even popular servers can have issues. An eval() in a Chrome extension with 7,000+ stars is the kind of thing that should get caught before users install it. Google's own CLI requesting broad filesystem and network access might be fine for its use case, but you should know about it.

Third, the MCP protocol itself doesn't enforce permission boundaries. Servers declare what they need, but there's no enforcement layer. The audit can flag what a server requests, but it can't stop a server from doing more than it claims. Runtime monitoring is a separate problem, and it's not solved yet.

If you're installing MCP servers, check them first. The two minutes it takes to run an audit is worth it.