The size of the problem
Model Context Protocol went from a November 2024 announcement to a category. Reported growth: 50 servers, then roughly 400, 2,500, 7,000, and an estimated 8,000-12,000 by Q2 2026 (Presenc AI, May 2026). Enterprise adoption is outpacing the community, and Anthropic has moved MCP into a Linux Foundation body, which is an institutionalization signal.
Now the discovery part: five public registries publish five different counts. Glama indexes roughly 37,800, mcp.so 10,000+, Smithery 6,000+, and PulseMCP curates about 1,200. The number a developer sees depends entirely on which directory they open. Correction, 2026-09-01: this piece originally reported that the official registry listed 30 servers, then corrected that on 2026-08-29 to 759. Both were wrong. The 759 figure was itself an undercount, a first-page-of-results sample stopped at an empty cursor instead of paged to true exhaustion. An exhaustive pull holds 26,300 unique servers, and the full corrected audit is in the registry audit.
What a real scan finds
I ran the free open-source scanner I maintain, mcp-scan, against two honest samples. First, this machine’s real AI tool configs: 5 servers, 907 ms, 0 critical, 1 high, 6 medium. The high finding was a missing license on a scoped package; the mediums were unverified publishers, an unknown external endpoint, and duplicate server definitions across tools. Nothing critical on a development workstation, but the dominant finding class is supply-chain metadata, which is exactly what hand-written checklists miss.
Second, the official registry itself. Of the 30 servers on its first page, 15 expose streamable-http remotes; scanning those took 13 ms and returned 0 critical, 0 high, 15 medium, all of the same class: every remote server contacts an external endpoint with no allowlist entry. The registry gives no machine-readable trust signal, so a default policy flags all of them. That is the honest aggregate, not a scare number.
curl -s https://registry.modelcontextprotocol.io/v0/servers -o mcp-registry.json # first page only: 30 of 759 servers; 15 of those expose streamable-http remotes npx mcp-scan@latest scan --config registry-config.json --json
These are point-in-time samples, not a market survey. Re-run on any machine and the numbers move. The pattern that does not move: unverified publishers, missing licenses, and unknown endpoints dominate what a config scanner finds.
The incidents behind the headlines
- Malicious MCP servers exfiltrating SSH keys via coding agents (ASSET Research Group, 2026-08-13).
- The Shai-Hulud npm supply-chain wave, including a compromised @bitwarden/cli.
- TrustFall: one-click RCE across Claude, Cursor, Gemini CLI, and Copilot.
- Azure DevOps hidden-PR-comment hijack of AI review agents.
Each is a five-minute “check yourself” exercise with a config scanner. The threat model is worth stating plainly: in 2026 the tool catalog is part of the prompt. Tool names, descriptions, and nested JSON-schema fields all enter model context at tools/list time, so injection payloads hide in schema fields, not just descriptions.
Where the tooling stands
The most-starred open-source scanner in the category, mcp-shield (555 stars), has been dormant since April 2025. Snyk ships MCP-Scan after acquiring Invariant Labs, which makes it the only institutionally backed player with a free tier. The long tail is mostly 0-6 stars. There is no incumbent owner of “the trusted MCP security scanner” brand, and the distribution layer is wide open.
How to check your own setup
Run the free scanner locally: npx mcp-scan@latest (no install, no account, no telemetry; macOS users can brew install mcp-scan). If you need a shareable report for a customer, auditor, or teammate, or a human to review actual configs and make the call, ThynkQ offers both.