We read 25 MCP servers: only 5 document a read-only mode, 3 send telemetry by default
LeastAd2616 · reddit · 2026-10-20
The agentshortlist.dev team went through the docs and source of 25 MCP servers and summarized security and capability disclosures.
Findings:
- Read-only mode: documented in only 5 of 25 (GitHub, n8n-mcp, MongoDB, DBHub, pREST); none found for Playwright, Desktop Commander, the MySQL server and others, with 13 unverifiable
- Telemetry: Chrome DevTools MCP, the Apify server and Blender MCP send telemetry by default; all three document how to turn it off
- Advisories: 40 published advisories on OSV.dev across 24 packages; none affects the latest npm/PyPI versions checked, but older versions are affected — pinning matters
The author notes this isn't an audit, just what docs and source said on Oct 18-19, with corrections welcome.
More from coding & agent
- Classification doesn't need the biggest model: matching complexity to task and cost — js_craft_hq · 2026-10-20
- Auto-research on idle GPUs: a CoreWeave pipeline that keeps agents busy — _ScottCondron · 2026-10-20
- Seedance 2.5 to playable game: 3-hour MVP claim from viral skate clip — MoonL88537 · 2026-10-20
- Stop Letting Your Agent Say 'Done': Mac MCP Author on Tool Success vs Task Success — bulutarkan · 2026-10-20
- Mac MCP Adds Six-Digit Pairing and Tiered Access for Agents Working Across Two Macs — bulutarkan · 2026-10-20
- From data scientist to AI engineer: a 9-step 2026 shipping roadmap — mdancho84 · 2026-10-20