State of MCP Security: Q2 2026
A data-driven look at the security posture of the MCP server ecosystem. April 2026.
The Model Context Protocol has become the standard way to connect AI agents to external tools. Anthropic introduced it, OpenAI adopted it, and the open-source ecosystem built hundreds of servers for everything from file management to browser control to database access. But how secure is this ecosystem?
I used audit.pyfio.com to scan the 50 most-starred MCP servers on GitHub. This report summarizes the findings, identifies the most common security issues, and outlines what needs to change as MCP adoption accelerates.
Key findings
The analysis gap is the biggest risk
43 of 50 servers (86%) could not be fully analyzed for code safety because they are written in Go, Rust, Python, or C#. The scanner currently focuses on JavaScript and TypeScript static analysis. This means the most widely-used MCP servers in the ecosystem have incomplete security assessments.
This is not just a tooling limitation. It means the community does not have a way to systematically evaluate the code safety of most MCP servers. The average code safety score of 81.6 is based on incomplete data and should not be treated as a reliable indicator of ecosystem health.
Dynamic code execution in production servers
One server (browser-tools-mcp, 7,000+ stars) contained an eval() call in a Chrome extension. This is the only critical-severity finding in the dataset, but it demonstrates that dangerous code patterns exist even in popular, widely-installed servers. The server scored 81, the lowest in the dataset.
Supply chain hygiene is inconsistent
5 of 50 servers had no lockfile. 3 had dependency names that flagged as potentially suspicious. 3 had install scripts that run automatically during installation. While none of these are confirmed vulnerabilities, they represent attack surface that is easy to reduce.
Transparency gaps persist
11 of 50 servers had no permissions or security documentation. 2 had no LICENSE file at all. For an ecosystem that asks users to grant filesystem, network, and execution access, the bar for transparency documentation is remarkably low.
Category averages
- Permissions and Scope (30%): 98.7. The strongest category. Most servers do not request excessive permissions.
- Transparency (15%): 95.1. Generally good. LICENSE files and basic documentation are common.
- Maintenance (10%): 93.0. Popular repos are actively maintained. High issue counts reflect popularity, not neglect.
- Supply Chain (20%): 84.0. The second-weakest category. Missing lockfiles and install scripts are common.
- Code Safety (25%): 81.6. The weakest category, but largely because 86% of servers could not be fully analyzed.
Ecosystem trends
MCP adoption is outpacing security tooling
The number of MCP servers on GitHub has grown rapidly since Anthropic's initial release and accelerated after OpenAI adopted the protocol. Security tooling has not kept pace. Most developers install servers based on star count and README quality, with no systematic evaluation of code safety, permissions, or supply chain risk.
Language diversity creates blind spots
The MCP ecosystem is multi-language by design. Servers can be written in any language that supports JSON-RPC. This is good for adoption but creates challenges for security analysis. A scanner that handles JavaScript, Go, Rust, and Python needs four different analysis engines. Building comprehensive multi-language analysis is a significant engineering investment.
No runtime enforcement exists
The MCP protocol defines how agents communicate with servers but does not enforce permission boundaries at runtime. A server can declare one set of capabilities and actually do something different. There is no built-in sandboxing, no capability-based security, and no monitoring framework. Static analysis (pre-installation auditing) is currently the only systematic defense.
Enterprise adoption is driving demand for compliance
With the EU AI Act taking effect in August 2026, enterprises deploying MCP-based agent systems are starting to ask for security documentation, audit reports, and compliance evidence. This is creating pressure on server maintainers to improve transparency and on the ecosystem to develop better tooling.
Recommendations
For MCP server developers
- Add a lockfile if you do not have one. This is the easiest fix.
- Document your permissions. What does your server access, and why?
- Remove or isolate dynamic code execution. If you must use
eval(), document why and restrict its inputs. - Run an audit on your own server. Fix what you can. Document what you cannot.
For MCP server users
- Audit before installing. Use audit.pyfio.com or review the code manually.
- Minimize the number of servers in your config. Each server is additional attack surface.
- Prefer servers with complete audit reports. A 90+ score from a full analysis is more meaningful than a 95 with "no source files found."
- Watch for the EU AI Act deadline if you operate in Europe.
For the ecosystem
- Multi-language static analysis is the most impactful investment. Covering Go and Python would increase the analyzable portion from 14% to approximately 70% of the ecosystem.
- Runtime monitoring and sandboxing for MCP servers would close the enforcement gap.
- A standard format for MCP server security documentation (similar to SECURITY.md) would improve transparency at scale.
What comes next
This is the first edition of this report. I plan to publish it quarterly. The Q3 2026 edition will include a larger sample (targeting 200 servers), expanded language support in the scanner, and trend comparisons showing how ecosystem security is evolving.
If you want to be notified when the next report drops, subscribe below.
Scan your MCP servers
Free security audits. See how your servers compare to the ecosystem.
Try audit.pyfio.com View LeaderboardGet the next report
Quarterly security reports plus weekly MCP updates. No spam.