Independent safety audit of the MCP server ecosystem · by PulseFeed
Thousands of MCP servers ship with almost no vetting — and a bad one can run arbitrary code on your machine or exfiltrate data. Before you connect your AI agent to an MCP server, check it. We audit maintenance, install-script risk, provenance, abandonment and liveness.
npm servers get deep signals; remote servers get liveness + HTTPS only (can't fully verify a black-box remote).
install_script = arbitrary code on npm i; abandoned = stale; unreachable = dead remote.
| Server | Type | npm dl/wk | Trust |
|---|---|---|---|
| @modelcontextprotocol/sdk | npm | 40,131,965 | 100 |
| ai | npm | 18,077,596 | 100 |
| @ai-sdk/mcp | npm | 2,807,887 | 100 |
| @storybook/mcp | npm | 1,596,608 | 100 |
| @storybook/addon-mcp | npm | 1,463,451 | 100 |
| mcporter | npm | 422,750 | 100 |
| @assistant-ui/react | npm | 1,319,267 | 100 |
| mcp-handler | npm | 736,707 | 100 |
| @copilotkit/aimock | npm | 1,201,032 | 100 |
| fallow | npm | 820,628 | 100 |
| mcp-remote | npm | 778,299 | 100 |
| @langchain/mcp-adapters | npm | 200,676 | 100 |
| add-mcp | npm | 101,915 | 100 |
| eve | npm | 668,693 | 100 |
| @modelcontextprotocol/server | npm | 4,209,166 | 100 |
GET /mcp/verify?package=<npm-name> — free. Returns a safety verdict, score and flags (install scripts, abandonment, provenance, license, repo).Methodology: PulseFeed discovers servers from the official MCP registry, audits each via npm metadata (install scripts, provenance, license, downloads, freshness) and liveness for remotes. Same independent-audit approach as our x402 trust oracle. Machine-readable: /mcp.json. Updated daily.