365 public MCP servers tested: 51% lack tool input descriptions, the most common bug
abhiramreddykalluru · reddit · 2026-10-27
A developer ran QAmcp, his open-source MCP server tester, against 365 public remote servers from the official MCP Registry (Oct 18-26) in safe mode. Key findings: 66 of 129 fully tested servers (51%) have tool inputs with no description (limit, id, slug, locale), 26% accept wrong input types without error, 25% run outdated MCP versions, and 9% of 1,806 tools lack read/write safety labels. Good news: zero tool poisoning found, no secrets leaked in errors, and 207/219 checked login setups follow AI-app auth rules. Average score: 88/100. Raw data published under CC BY 4.0.
More from coding & agent
- DeepSeek Harness plugin ecosystem is booming as cheap, mid-tier-but-solid model draws tinkerers — op7418 · 2026-10-27
- Open-source auto-research agent hits Top 2 on GPU kernel challenge in 7 hours — sguada · 2026-10-27
- 'Codex decided': devs admit making up reasons in code review for agent-written code — FlatStill2540 · 2026-10-27
- Running AI agents on a legacy IBM WMS: enforce tool order, script checks, verify evidence — ksrijith · 2026-10-27
- 300 Agents, 60 People: Runlayer Found Engineer Details Real-World Agent Security Failures — AI Engineer · 2026-10-27
- CoreWeave ARIA agent ships four new live in-chat panels for ML run analysis — _ScottCondron · 2026-10-27