The MCP Ecosystem Has 15,382 Servers — Here's Why You Can't Trust Any of Them

I’ve been staring at these numbers all morning. They keep getting worse.

The MCP Census just scanned every public MCP (Model Context Protocol) server in the official registry — 15,382 in total. What they found isn’t a “growing pain.” It’s a supply chain crisis that makes the OpenClaw situation look like the warm-up act.

The Numbers That Should Scare You

1,880 servers point to deleted GitHub repos. The source code is gone. You can’t audit it, fork it, or even prove it ever did what its manifest claimed. These servers are running in the wild, connected to thousands of AI agents, and nobody knows what they actually execute.

888 repos have no license assertion. Legally, that means default copyright applies — you don’t have permission to use, modify, or redistribute them. But worse: no license means no contributor agreement, no liability protection, and no way to know if someone embedded GPL-licensed code into your agent’s dependency tree.

638 servers share the name “mcp.” 45 names are used by 5+ different servers. Typosquatting isn’t just possible — it’s baked into the registry’s architecture. Installing mcp-filesystem vs mcp-filesystem-official? Good luck telling them apart.

The Long Tail of Invisible Servers

9,207 servers — 60% of the ecosystem — have fewer than 10 GitHub stars. No community review. No security audits. Nobody is watching. These are the digital equivalent of an unlabeled USB stick found in a parking lot — and your AI agent will happily plug it in.

299 servers haven’t been touched in six months. In a framework barely a year old, that’s ancient. Unmaintained means unpatched — and these servers often depend on npm packages that are still being updated, creating silent compatibility drift.

218 npm packages were deprecated by their own authors. Not abandoned — deprecated with a warning not to use them. Somewhere in the dependency tree of a popular MCP server, that deprecated package is still being resolved at install time.

Dev-Tools: 11,697 Servers With Shell Access

The dev-tools category dominates at 11,697 servers — filesystem access, shell execution, network socket creation, arbitrary command injection. These servers are designed to give an AI agent the same privileges as the user running it.

That’s not a feature. That’s a security model that assumes every MCP server is benevolent.

But we’re not working with benevolent code. We’re working with a supply chain where 1 in 12 servers has a deleted or unlicensed codebase, 6 in 10 have zero community validation, and 1 in 70 hasn’t been updated since before the last major security patch.

We Already Know What Happens Next

This isn’t theoretical. OpenClaw’s ClawHub marketplace was infected with 341 malicious skills — a 12% infection rate. The worst, tracked as CVE-2026-25253 with a CVSS score of 8.8, allowed one-click RCE through a skill that claimed to be a “file system listing tool.”

Five of those skills bypassed both ClawScan and VirusTotal screening. The malicious code was invisible to automated detection because it inherited the agent’s authenticated identity.

Compare that to npm’s worst month on record: roughly 0.2% of new packages are malicious. The AI agent ecosystem’s risk surface is 60 times higher than the supply chain everyone already fears. And the MCP ecosystem is 5x larger than ClawHub.

Why Your AI Agent Is the Perfect Victim

Here’s the core insight from the MCP Census that should keep every CISO awake: AI coding agents connect to MCP servers using the agent’s own identity.

When your agent runs an MCP server that declares “I can read your file system,” the agent doesn’t sandbox it. The server runs with your credentials — your SSH keys, your environment variables, your cloud provider tokens. One malicious MCP server with shell access equals full system compromise. No exploit. No zero-day. Just a curl command in a server.py that nobody ever reviewed.

As Sophos X-Ops documented last week, AI coding agents executing tool calls are behaviorally indistinguishable from human attackers. Your EDR can’t tell whether that shell command came from your Claude Code agent or a threat actor.

What Has to Change

First, the MCP registry needs mandatory minimums: every server must have a verified source repository and a recognizable license before it’s listed. 1,880 deleted repos and 888 unlicensed packages are indefensible at 15K scale.

Second, agent frameworks must sandbox MCP servers by default. Least privilege isn’t optional when 11,697 servers have filesystem access and the median star count is zero. Code Airlock and similar sandboxing tools are a start, but they shouldn’t be opt-in.

Third, if you’re running an AI agent with MCP tool access in production, audit your supply chain now. Not next quarter. Not after the next OpenClaw. Map every MCP server to a verified source repo, check every license, and remove anything you can’t trace to a maintainer you trust.

The Bigger Picture

The MCP Census is the third major AI agent supply chain warning in less than a month:

• Jun 30: Claude Code steganography — Anthropic embedding invisible tracking markers in system prompts (2,444 points on HN)
• Jul 6: OpenClaw crisis — 341 malicious skills, 12% infection rate, all major providers blocking
• Jul 11: MCP Census — 15K servers, 1,880 deleted repos, zero audit infrastructure

The pattern is clear: AI agent supply chains are growing 60x faster than the security infrastructure needed to audit them. Every new MCP server is a potential attack vector. Every deleted repo is evidence you can’t recover. Every unlicensed package is a legal time bomb.

Don’t wait for a CVE with your company’s name on it. Audit your agent’s tool access today.

— dotfm audits AI agent security. We find the supply chain risks automated scanners miss.