I scanned 8,845 MCP servers for malware. Here are the results.

#security #malware #devsecops #mcp

I ran our 9-layer Sentinel pipeline on every MCP server in our catalog. Here's what I found.

The scan

8,845 MCP servers from GitHub repos, each audited by:

L1.5: 6 metadata checks
L1.6: 18 Semgrep rules + 18 secret patterns + OSV dependency check
L1.7: Binary/launcher detection (opens the actual package zip)
L1.8: 17 malware family signatures (Emotet, Cobalt Strike, Mimikatz, RedLine, etc.)
L3: Continuous runtime monitoring (drift detection vs L2 baseline)

Results

Metric	Count
Total scanned	8,845
Score 10/10 (clean)	6
Score 8-9 (low risk)	6,311
Score 5-7 (medium risk)	1,892
Score 1-4 (high risk)	536
Score 0 (critical)	22
Quarantined	0
Trojans found	0 (after L1.7 was deployed)

What the scores mean

10/10: Perfect — no findings across all layers. Only 6 skills achieved this.
8-9: Low risk — minor warnings (e.g., "no rate limiting declared" or "server-side execution without auth"). Safe to use.
5-7: Medium risk — some concerns (e.g., file system access, database access, HTTP access detected in metadata). Review before using.
1-4: High risk — significant findings (e.g., known vulnerable dependencies, hardcoded secrets in description, prompt injection patterns). Avoid in production.
0: Critical — malware family match or binary detected. Quarantined.

The 6 perfect-score skills

These passed all 9 layers with zero findings:

A filesystem MCP server (official Anthropic reference)
A memory MCP server (official Anthropic reference)
A git MCP server (official Anthropic reference)
A time MCP server (official Anthropic reference)
A fetch MCP server (official Anthropic reference)
A sequential thinking MCP server (official Anthropic reference)

All 6 are Anthropic's official reference servers. They set the bar for what "clean" looks like.

What changed since the trojan

Two weeks ago, a typosquatting repo slipped a Windows trojan into the catalog via a fake "Download Latest Release" badge. Since then:

L1.7 scans inside every package zip (recursively — zips inside zips)
L1.8 checks 17 malware family signatures
L3 re-audits weekly and detects behavioral drift
Honeypot auto-bans anyone scanning for /.env, /admin, /.git/config
WAF blocks 40 attack patterns (SQLi, XSS, SSRF, path traversal)
Threat intel checks URLs against URLhaus (1000+ malicious URLs)

Try it

# Audit any skill in real-time
curl "https://marketnow.site/api/audit-skill?skillId=mn-mcp-filesystem" | jq .audit.overall_score

# Check the security overview
curl "https://marketnow.site/api/security" | jq .layers

# Get the CA public key for ATC verification
curl "https://marketnow.site/api/atc?action=ca-key" | jq .public_key_pem