Auditing the top 99 MCP servers: no tool poisoning, the real bugs are in HTTP mode
Trout_dev · reddit · 2026-11-06
A developer scanned the top 100 GitHub MCP servers (99 worked) with their mcp-audit scanner and manually reviewed every serious finding across 9,965 tools.
Key findings:
- Zero tool poisoning: no hidden instructions or encoded text in any tool description — the risk lives in random small servers, not popular ones.
- Over-broad tools everywhere: 13 repos ship tools that run any command, fetch any URL, or touch any file, so one prompt injection can do anything you can.
- The real bugs are in HTTP mode: of 6 servers supporting HTTP, 3 listen on all interfaces with no auth by default; in one, anyone on your network could send messages via your Telegram, email, or Slack (reported privately).
- Tools can change after approval: 14 repos swap tool lists at runtime; 25 build descriptions in code.
- No leaked secrets — all 4 strong matches were benign.
Advice: bind HTTP servers to 127.0.0.1 or put a token in front; pin tools with mcp-audit --pin tools.lock.json. Available via pip install mcp-tool-audit.
More from coding & agent
- Team's 24/7 infra-monitoring agent spots anomalies 'before the fire,' user says — antoine_chaffin · 2026-11-06
- Delvetown: a human-agent "post-scarcity" web community, plus agents emailing researchers unbidden — Miles_Brundage · 2026-11-06
- Every team demos Codex and Claude workflows for running AI as your OS — every · 2026-11-06
- Hyperagent launches Sizzle, an agent that reads PRs and auto-produces polished demo videos — aakashgupta · 2026-11-06
- Vercel publishes CLI design guidelines for humans and AI agents — JohnPhamous · 2026-11-06
- Dev builds a sculpting tool for Apple Vision Pro using Codex — OpenAIDevs · 2026-11-06