The size of the problem
Model Context Protocol went from a November 2024 announcement to a category. Reported growth: 50 servers, then roughly 400, 2,500, 7,000, and an estimated 8,000-12,000 by Q2 2026 (Presenc AI, May 2026). Enterprise adoption is outpacing the community, and Anthropic has moved MCP into a Linux Foundation body, which is an institutionalization signal.
Now the discovery part: five public registries publish five different counts. Glama indexes roughly 37,800, mcp.so 10,000+, Smithery 6,000+, PulseMCP curates about 1,200, and the official Anthropic registry lists 30 servers (verified by live query on 2026-08-15). The number a developer sees depends entirely on which directory they open.
What a real scan finds
I ran the free open-source scanner I maintain, mcp-scan, against two honest samples. First, this machine’s real AI tool configs: 5 servers, 907 ms, 0 critical, 1 high, 6 medium. The high finding was a missing license on a scoped package; the mediums were unverified publishers, an unknown external endpoint, and duplicate server definitions across tools. Nothing critical on a development workstation, but the dominant finding class is supply-chain metadata, which is exactly what hand-written checklists miss.
Second, the official registry itself. Of the 30 listed servers, 15 expose streamable-http remotes; scanning those took 13 ms and returned 0 critical, 0 high, 15 medium, all of the same class: every remote server contacts an external endpoint with no allowlist entry. The registry gives no machine-readable trust signal, so a default policy flags all of them. That is the honest aggregate, not a scare number.
curl -s https://registry.modelcontextprotocol.io/v0/servers -o mcp-registry.json # 30 servers listed; 15 expose streamable-http remotes npx mcp-scan@latest scan --config registry-config.json --json
These are point-in-time samples, not a market survey. Re-run on any machine and the numbers move. The pattern that does not move: unverified publishers, missing licenses, and unknown endpoints dominate what a config scanner finds.
The incidents behind the headlines
- Malicious MCP servers exfiltrating SSH keys via coding agents (ASSET Research Group, 2026-08-13).
- The Shai-Hulud npm supply-chain wave, including a compromised @bitwarden/cli.
- TrustFall: one-click RCE across Claude, Cursor, Gemini CLI, and Copilot.
- Azure DevOps hidden-PR-comment hijack of AI review agents.
Each is a five-minute “check yourself” exercise with a config scanner. The threat model is worth stating plainly: in 2026 the tool catalog is part of the prompt. Tool names, descriptions, and nested JSON-schema fields all enter model context at tools/list time, so injection payloads hide in schema fields, not just descriptions.
Where the tooling stands
The most-starred open-source scanner in the category, mcp-shield (555 stars), has been dormant since April 2025. Snyk ships MCP-Scan after acquiring Invariant Labs, which makes it the only institutionally backed player with a free tier. The long tail is mostly 0-6 stars. There is no incumbent owner of “the trusted MCP security scanner” brand, and the distribution layer is wide open.
How to check your own setup
Run the free scanner locally: npx mcp-scan@latest (no install, no account, no telemetry; macOS users can brew install mcp-scan). If you need a shareable report for a customer, auditor, or teammate, or a human to review actual configs and make the call, ThynkQ offers both.