Independent safety audit of the MCP server ecosystem · by PulseFeed
Thousands of MCP servers ship with almost no vetting — and a bad one can run arbitrary code on your machine or exfiltrate data. Before you connect your AI agent to an MCP server, check it. We audit maintenance, install-script risk, provenance, abandonment and liveness.
npm servers get deep signals; remote servers get liveness + HTTPS only (can't fully verify a black-box remote).
install_script = arbitrary code on npm i; abandoned = stale; unreachable = dead remote.
| Server | Type | npm dl/wk | Trust |
|---|---|---|---|
| @modelcontextprotocol/sdk | npm | 45,520,029 | 100 |
| ai | npm | 18,704,349 | 100 |
| @ai-sdk/mcp | npm | 1,935,494 | 100 |
| @storybook/mcp | npm | 1,975,587 | 100 |
| @storybook/addon-mcp | npm | 1,645,260 | 100 |
| @assistant-ui/react | npm | 1,472,507 | 100 |
| @copilotkit/aimock | npm | 832,758 | 100 |
| fallow | npm | 630,425 | 100 |
| add-mcp | npm | 225,622 | 100 |
| eve | npm | 356,626 | 100 |
| @modelcontextprotocol/server | npm | 188,403 | 100 |
| figma-developer-mcp | npm | 82,379 | 100 |
| n8n-mcp | npm | 97,264 | 100 |
| @raishin/vanguard-frontier-agentic | npm | 210,710 | 100 |
| @sap-ux/fiori-docs-embeddings | npm | 110,908 | 100 |
GET /mcp/verify?package=<npm-name> — free. Returns a safety verdict, score and flags (install scripts, abandonment, provenance, license, repo).Methodology: PulseFeed discovers servers from the official MCP registry, audits each via npm metadata (install scripts, provenance, license, downloads, freshness) and liveness for remotes. Same independent-audit approach as our x402 trust oracle. Machine-readable: /mcp.json. Updated daily.