Beware of MCPs... or just don't connect to random ones. (8000 scans later)

Over the past few months we’ve been running the MCP Trust Registry, scanning publicly available MCP servers to better understand what agents are actually connecting to.

We’ve analyzed 8,000+ servers so far using 22 rules mapped to the OWASP MCP Top 10.

Some findings:

• ~36.7% exposed unbounded URI handling → SSRF risk (same class of issue we disclosed in Microsoft’s Markitdown MCP server that allowed retrieval of instance metadata credentials)
• ~43% had command execution paths that could potentially be abused
• ~9.2% included critical-severity findings

Nothing particularly exotic, largely the same security failures appearing in MCP implementations

This raised a question for us: How are people deciding which MCP servers their agents should trust or avoid? Manual Review? Strict whitelisting? Something else?

Adding tools/servers is easy. Reasoning about trust, failure modes, and downstream execution risk is much less clear.

Happy to share methodology details or specific vuln patterns if useful.