MCP Security Audit: 10 GitHub Repos Scanned

DEV Community

I Scanned 10 Popular MCP Server Repositories on GitHub (4,409 Files) — Here Are the Security & Token Bloat Results

As AI coding agents (Claude Code, Cursor, Windsurf, GitHub Copilot, and Zed) rapidly adopt the Model Context Protocol (MCP), repositories are shipping .mcp.json configs, tool definitions, and agent workflows faster than security teams can review them. To measure the real-world security posture and LLM token efficiency across the ecosystem, I ran RepoXray (npx rxray)—an open-source, zero-dependency static security & supply-chain scanner—against 10 widely used MCP repositories on GitHub. ⚡ Audit Snapshot (TL;DR) Total Files Scanned: 4,409 files across 10 popular MCP repos Average Scan Speed: 1.53 seconds per repository (100% local static analysis) Supply-Chain Risk: 70% of scanned repos contained dependencies with known CVEs Context Bloat: 100% lacked an .aiignore file, wasting 2.17M+ tokens on lockfiles and build artifacts 📊 Aggregate Findings Across 10 MCP Repositories Repository Score Grade Scan Time 🔴 Critical 🟠 High 🟡 Med Optimizable LLM Tokens tavily-ai/tavily-mcp 99/100 🟢 A+ 0.77s 0 0 1 15,073 (46%) modelcontextprotocol/servers 91/100 🟢 A 1.49s 0 0 5 335,953 (24%) lastmile-ai/mcp-agent 68/100 🟡 C 0.89s 1 0 1 925,638 (34%) executeautomation/mcp-playwright 68/100 🟡 C 1.67s 1 1 1 340,576 (74%) browserbase/mcp-server-browserbase 68/100 🟡 C 0.98s 1 2 1 58,969 (67%) mendableai/firecrawl-mcp-server 68/100 🟡 C 1.15s 1 1 1 119,947 (26%) excalidraw/excalidraw-mcp 64/100 🟡 C 2.80s 2 4 2 38,593 (43%) modelcontextprotocol/inspector 63/100 🟡 C 2.62s 4 5 2 179,301 (4%) punkpeye/fastmcp 50/100 🟠 D 1.57s 3 9 1 68,102 (11%) upstash/context7 28/100 🔴 F 1.42s 12 4 1 87,521 (10%) Note: Scans were executed against the default branch of each repository using npx rxray. Scores reflect static security rules, OSV.dev advisory lookups, and AI context hygiene. 🔍 3 Key Takeaways From the Audit 1. 70% of Scanned Repos Have Dependencies With Known CVEs (SC-OSV-VULNERABILITY) 7 out of 10 repositories contained direct or transitive manifest versions with security advisories published in OSV.dev. Why this matters for MCP: Unlike sandboxed web apps, MCP servers execute locally on developer workstations—frequently holding privileges to read/write local filesystems, control headless browsers, and access production API keys. A vulnerable dependency inside an MCP server carries immediate local code execution risk. 2. Unpinned npx -y and Mutable Git References in MCP Configs Several MCP configurations and README setup guides instruct developers to launch servers using mutable targets: Unpinned Registry Execution (SEC-MCP-UNPINNED-NPX): Running npx -y some-mcp-server@latest auto-downloads and executes whatever version was pushed most recently without user confirmation. Mutable Git Branches (SC-MCP-UNPINNED-GIT): Using npx github:owner/repo or uvx --from git+https://... without pinning to an immutable 40-character commit SHA. The Risk: If an upstream npm maintainer account is hijacked or a Git tag is force-pushed, every developer opening their IDE automatically pulls and executes the malicious payload on startup.
json
// ❌ Risky: Pulls latest unverified code on every IDE startup
{
"mcpServers": {
"example": {
"command": "npx",
"args": ["-y", "some-mcp-server@latest"]
}
}
}

// ✅ Safer: Pin to an exact, audited version
{
"mcpServers": {
"example": {
"command": "npx",
"args": ["[email protected]"]
}
}
}

1. 100% Lacked an .aiignore File — Wasting 2.17 Million Context Tokens
   None of the 10 repositories included an .aiignore (or .cursorignore / .claudeignore) file.

Across the 10 repos, 2,169,673 tokens came purely from lockfiles (package-lock.json, pnpm-lock.yaml, uv.lock), minified bundles, and static JSON fixtures. When coding agents index a repository without context ignore rules, this noise pollutes the LLM context window, increases API costs, and degrades reasoning quality.

🛠️ Test Your Own Repository in <2 Seconds (Zero Dependencies)
You can run the exact same audit on your own codebase ...

Powered by Readybot.io