Large-Scale MCP Audit Reveals Critical Supply Chain Trust Gaps

This unprecedented security assessment of 5,154 MCP servers exposes a significant trust deficit in the ecosystem. While live-verified servers maintain a respectable average trust score of 76/100, static npm packages lag significantly at 54/100, revealing a two-tier ecosystem. The analysis found that supply chain vulnerabilities account for 71% of all security issues—most servers lack provenance attestation, depend on single maintainers for security, and show evidence of impersonation attacks. As MCP adoption accelerates in AI applications, these systemic gaps represent a growing threat to downstream agents and the applications they power.