Body:
We froze a SHA-256-anchored census of the public MCP ecosystem on 2026-10-12:
42,163 servers, 229,539 tool parameter schemas. Every number below recomputes
from the frozen exports (screening script, CC0):
- 3,456 servers ship a funds-movement surface. 1,301 of them have write polarity — tools that can move money, not just read balances.
- 2,663 servers combine money AND credential handling in one trust boundary. If a prompt injection lands on one of these, the blast radius is "spend" not "read".
- 9,761 servers touch account identity data in tool parameters.
The uncomfortable part: this is only the public ecosystem. Enterprise-internal
MCP deployments — invisible to any census — are where the regulated traffic
actually lives.
What we did about it (and what you can reuse, CC0):
- A risk gazetteer schema where every label must carry an evidence chain (frozen parameter path + vocabulary rule ref). No naked labels — an unlabeled claim is unverifiable and must be omitted. We think "no naked labels" is the difference between a risk list and a liability.
- A signed receipt format (Ed25519 over RFC 8785 canonical bytes, hash-chained, offline-verifiable) so a decision record can be checked by a third party without trusting either the agent or the tool host.
- A fail-closed rollback-evidence receipt: an "executed reversal" claim without a transaction reference is rejected by the checker. "We compensated" is not evidence; a verifiable reversal bound to the original decision is.
Census: Zenodo DOI 10.5281/zenodo.24028716 (white paper)
Code + schema: github.com/DSHCorrectover/mcp-risk-gazetteer (CC0)
Vectors + checker: github.com/DSHCorrectover/ccs-conformance-vectors (CC0 data / MIT checker)
We would rather be corrected than wrong — if you recompute the numbers and
get something else, that's a bug report we want.
Top comments (1)
Freezing the census with hashes is the right call. Tool definitions change after people approve them, so a dated snapshot is the only way two people can argue about the same numbers.
One question: of the 1,301 servers with write polarity, can you split remote servers from local stdio ones? For the remote ones the next question is auth. When we checked 61 official SaaS MCP servers from the outside on Nov 4, all returned a 401 and supported PKCE, but 40 did not advertise the RFC 9207 issuer check. A money-moving tool behind weak client checks is a different risk from one that only runs on the user's own machine.