Half of ~1,850 audited MCP servers are abandoned: Preflight scans them before you connect
atp_studio_coll · reddit · 2026-09-03
A developer built Preflight, a scanner that checks MCP servers (and plain REST APIs) before you connect, addressing a systemic blind spot: nobody audits a tool's description before granting it access to run shell commands or read env vars.
The numbers are worse than expected
- Rapid Claw's 2026 audit of 1,850 MCP servers found roughly half abandoned — no maintainer, no fixes, still connectable
- Censys found 12,000+ MCP servers exposed to the open internet with no meaningful access controls
- A documented trojan (postmark-mcp) silently forwarded email for weeks before detection
What Preflight does
- Flags servers handing over tool lists with zero auth, tools granting filesystem/shell/credential access without input scoping, and known-bad signatures
- A semantic pass reads tool descriptions the way an agent would, looking for prompt-injection phrasing aimed at the model
- Tested against production servers (Linear, Sentry, Atlassian) — all correctly recognized as OAuth-gated, no false positives
- Core checks free, no signup, rate-limited to 20 scans/min
More from coding & agent
- MCP Platform NitroStack Wins Product Hunt Product of the Day, Focuses on Retention — EstablishmentFun4373 · 2026-10-21
- CodeRabbit Ships 5,000 PRs a Week With a Tiny Team, Hires by Strategy-Game Hours — omojumiller · 2026-10-21
- LukeW maps the five UI problems every AI-native company faces with agents — LukeW · 2026-10-21
- Claude Code over ADB guts a bloatware-laden Android TV, freeing ~90% more RAM — edwinarbus · 2026-10-21
- Developer uses Claude to fix his adware-slowed Xiaomi TV, releases tool for any Android TV — edwinarbus · 2026-10-21
- Open-weights Ornith-1.5-122B debuts with 84.5% SWE-bench Verified, runs on a single DGX card — _akhaliq · 2026-10-21