MCP Registry Security Analysis

Overview

The MCP Registry (https://registry.modelcontextprotocol.io) is an unvalidated, open registry where anyone can publish MCP servers. Based on API analysis and video reviews, there is no verification or security vetting of submitted entries.

Current State of Registry

What We Found

From analyzing the registry API (October 2025):

Repository Quality:

✅ 73% have GitHub repos (73 out of 100 sampled)
⚠️ 27% have NO repository (empty repository.url field)
⚠️ Some appear to be test/demo servers (e.g., ai.alpic.test/test-mcp-server)

Available Metadata:

json

{
  "_meta": {
    "io.modelcontextprotocol.registry/official": {
      "status": "active",           // All show "active" (not a trust indicator)
      "publishedAt": "2025-10-09...",
      "updatedAt": "2025-10-09...",
      "isLatest": true
    }
  },
  "server": {
    "name": "ai.company/server-name",
    "repository": {
      "url": "https://github.com/...",  // Sometimes empty
      "source": "github"                 // Sometimes empty
    }
  }
}

Security Concerns

No Verification Process
- Anyone can publish to the registry
- No code review or security audit
- No reputation system
- No takedown process (unclear)
Missing Trust Indicators
- No "official" or "verified" badge
- status: "active" applied to ALL entries (not meaningful)
- No download counts visible
- No user ratings/reviews
Attack Vectors
- Malicious Code: Stdio servers execute arbitrary code on user's machine
- Typosquatting: Register names similar to popular servers
- Supply Chain: Compromise popular packages after gaining trust
- Data Exfiltration: HTTP/SSE servers can send sensitive data anywhere
- Credential Harvesting: Request fake env vars to steal API keys

What Filters Are Available?

Currently Exposed in API

Repository Information

typescript

repository: {
  url: string;      // Can filter: has repo vs no repo
  source: string;   // Can filter: "github" vs empty
}

Status (Not Useful)

typescript

status: "active"  // All entries show this

Dates

typescript

publishedAt: string;  // Can filter by age
updatedAt: string;    // Can detect abandoned packages

Transport Type

typescript

packages: []   // stdio server
remotes: []    // HTTP/SSE server

Namespace

typescript

name: "ai.company/server-name"  // Can filter by namespace

Currently NOT Available

❌ Verified/Official Badge - No way to distinguish Anthropic's official servers ❌ Download Counts - Can't filter by popularity ❌ Security Scan Results - No malware/vulnerability scanning ❌ User Reviews/Ratings - No community feedback ❌ Maintainer Reputation - No trust score ❌ License Information - No OSS license verification

Our Current Implementation

What We Show Users

From src/internal-mcps/ncp-management.ts:800:

typescript

const statusBadge = c.status === 'active' ? '⭐' : '📦';
const transportBadge = c.transport === 'stdio' ? '💻' : '🌐';

Problems:

⭐ badge shown for ALL servers (misleading)
No indication of trust/verification
No repository link shown
No warning about unverified sources

What We Filter By

From src/services/registry-client.ts:122:

typescript

const filtered = (data.servers || []).filter((s: ServerSearchResult) =>
  s.server.name.toLowerCase().includes(lowerQuery) ||
  s.server.description?.toLowerCase().includes(lowerQuery)
);

Only text search - no security filtering at all.

Security Recommendations

Immediate Actions (Can Implement Now)

1. Filter by Repository Presence

typescript

// Only show servers with GitHub repos
.filter(s => s.server.repository?.url && s.server.repository?.source === 'github')

Pros: Reduces attack surface by ~27% Cons: Excludes legitimate closed-source or self-hosted servers

2. Show Repository in Results

typescript

const repoInfo = c.repository?.url ? `\n  Repo: ${c.repository.url}` : '\n  ⚠️  No repository';

Pros: Users can inspect source before installing Cons: None

3. Namespace Allowlist (Optional)

typescript

const TRUSTED_NAMESPACES = [
  'io.github.modelcontextprotocol',  // Official Anthropic servers
  'com.github.microsoft',            // Microsoft
  'io.github.anthropics',            // Anthropic (if different)
];

// Priority sort: trusted first, then by date

Pros: Clear distinction between official and community Cons: Requires maintaining allowlist

4. Age Filter

typescript

const AGE_THRESHOLD_DAYS = 30;  // Only show servers published >30 days ago

Pros: New malicious servers can't be installed immediately Cons: Excludes brand new legitimate servers

5. Require Confirmation with Warning

Already implemented in src/internal-mcps/ncp-management.ts:213:

typescript

⚠️ Installing MCPs can execute arbitrary code on your system.
Only proceed if you trust this MCP server.

Enhancement: Add repository link to confirmation:

typescript

⚠️ SECURITY WARNING

Source: ${repoUrl || 'NO REPOSITORY - UNVERIFIED'}
Author: ${namespace}

This MCP will execute code on your machine. Only install if you:
1. Recognize the author
2. Have reviewed the source code
3. Trust this server completely

Medium-Term Improvements

6. Manual Curated List

Create our own curated list of verified servers:

json

{
  "verified": [
    {
      "name": "io.github.modelcontextprotocol/server-filesystem",
      "verifiedBy": "NCP Team",
      "verifiedDate": "2025-10-18",
      "reason": "Official Anthropic server"
    }
  ]
}

7. GitHub Star Count

Fetch GitHub stars as trust indicator:

typescript

async function getGitHubStars(repoUrl: string): Promise<number> {
  // Extract owner/repo from URL
  // Call GitHub API
  // Return star count
}

8. NPM Package Verification

For npx servers, check npm registry:

typescript

// Verify package exists on npm
// Check download counts
// Check publish date
// Check maintainer count

9. Local Allowlist/Blocklist

json

{
  "allowlist": ["filesystem", "github", "postgres"],
  "blocklist": ["ai.sketchy-server/*"]
}

Long-Term Solutions (Requires Registry Changes)

10. Verification System

Official badge for Anthropic-verified servers
Community verification (like GitHub sponsors)
Security scan results (SAST/dependency scanning)

11. Reputation System

User ratings/reviews
Download counts
Incident reports
Age of package

12. Sandboxing

Run MCPs in containers
Limit filesystem access
Network policy enforcement

Recommended Implementation Plan

Phase 1: Immediate (This Release)

[ ] Show repository URL in discovery results
[ ] Filter out servers with no repository (optional flag)
[ ] Enhanced confirmation dialog with source/author
[ ] Warning badge for unverified sources

Phase 2: Next Release

[ ] Trusted namespace allowlist
[ ] GitHub stars integration
[ ] NPM package verification
[ ] Manual curated list

Phase 3: Future

[ ] Reputation system (if registry adds it)
[ ] Local allowlist/blocklist
[ ] Sandboxing support

Security Best Practices for Users

What Users Should Do

Check the Source
- ✅ Has GitHub repository
- ✅ Active maintenance (recent commits)
- ✅ Many stars/forks
- ✅ Known author/organization
Review the Code
- Read the source before installing
- Check for suspicious network calls
- Look for credential harvesting
- Verify dependencies
Start with Official Servers
- Anthropic's official servers (io.github.modelcontextprotocol/*)
- Well-known companies (Microsoft, Docker, etc.)
- Popular community servers (high GitHub stars)
Use Profiles
- Isolate untrusted MCPs in separate profiles
- Limit access to sensitive data
- Monitor behavior

Red Flags

❌ No repository - Cannot inspect source ❌ Empty/generic description - Low effort ❌ Recently published - Not battle-tested ❌ Typosquatting - Similar name to popular server ❌ Requests unusual env vars - Potential credential harvesting ❌ HTTP/SSE to unknown domain - Data exfiltration risk

Example: Secure Discovery UI

📋 Found 5 MCPs matching "file":

1. ⭐💻 filesystem [VERIFIED]
   Official Anthropic file operations server
   ✓ Repository: github.com/modelcontextprotocol/servers
   ✓ Published: 2024-08-15 (287 days ago)
   ✓ Stars: 2,431

2. 📦💻 file-manager
   Community file manager with extras
   ⚠️  Repository: github.com/unknown-user/file-manager
   ⚠️  Published: 2025-10-10 (8 days ago)
   ⚠️  Stars: 3

3. 🚫💻 super-files
   ❌ NO REPOSITORY - Unverified source
   ❌ Published: 2025-10-17 (1 day ago)
   ❌ HIGH RISK - Do not install

Conclusion

The MCP Registry is currently unvalidated and poses security risks. We should:

✅ Immediately: Add repository filtering and enhanced warnings
⏳ Soon: Implement trust indicators (GitHub stars, curated list)
🔮 Future: Advocate for registry-level verification system

Security is our responsibility, not just the registry's. We must protect users from malicious servers through multiple layers of defense.

Related Files:

src/services/registry-client.ts - Registry API client
src/internal-mcps/ncp-management.ts - Discovery UI
PRE-RELEASE-CHECKLIST.md - Security review checklist

MCP Registry Security Analysis ​

Overview ​

Current State of Registry ​

What We Found ​

Security Concerns ​

What Filters Are Available? ​

Currently Exposed in API ​

Currently NOT Available ​

Our Current Implementation ​

What We Show Users ​

What We Filter By ​

Security Recommendations ​

Immediate Actions (Can Implement Now) ​

1. Filter by Repository Presence ​

2. Show Repository in Results ​

3. Namespace Allowlist (Optional) ​

4. Age Filter ​

5. Require Confirmation with Warning ​

Medium-Term Improvements ​

6. Manual Curated List ​

7. GitHub Star Count ​

8. NPM Package Verification ​

9. Local Allowlist/Blocklist ​

Long-Term Solutions (Requires Registry Changes) ​

10. Verification System ​

11. Reputation System ​

12. Sandboxing ​

Recommended Implementation Plan ​

Phase 1: Immediate (This Release) ​

Phase 2: Next Release ​

Phase 3: Future ​

Security Best Practices for Users ​

What Users Should Do ​

Red Flags ​

Example: Secure Discovery UI ​

Conclusion ​

MCP Registry Security Analysis

Overview

Current State of Registry

What We Found

Security Concerns

What Filters Are Available?

Currently Exposed in API

Currently NOT Available

Our Current Implementation

What We Show Users

What We Filter By

Security Recommendations

Immediate Actions (Can Implement Now)

1. Filter by Repository Presence

2. Show Repository in Results

3. Namespace Allowlist (Optional)

4. Age Filter

5. Require Confirmation with Warning

Medium-Term Improvements

6. Manual Curated List

7. GitHub Star Count

8. NPM Package Verification

9. Local Allowlist/Blocklist

Long-Term Solutions (Requires Registry Changes)

10. Verification System

11. Reputation System

12. Sandboxing

Recommended Implementation Plan

Phase 1: Immediate (This Release)

Phase 2: Next Release

Phase 3: Future

Security Best Practices for Users

What Users Should Do

Red Flags

Example: Secure Discovery UI

Conclusion