The MCP safety directory rates 27 public MCP servers from the State of MCP Security 2026 probe — six unauthenticated handshake probes per endpoint, measuring whether servers silently downgrade the newest protocol era. This AI agents 2026 directory reports negotiation behavior only; it is not a certification.
Key figure: 63% of organizations in IBM's 2025 breach study had no AI governance policy, and 97% of AI-breach victims had no proper AI access controls (IBM, Cost of a Data Breach Report 2025).
— Ingenious AI security check.
The directory grades each server on six probes: whether it silently downgraded the newest protocol era is the headline signal. These ratings reflect one unauthenticated probe run — negotiation behavior only, not a certification. A silent downgrade is not proof of malice, but it is a reason to pin versions and verify.
The open standard that lets AI agents connect to external tools and data sources — and a new attack surface, since a malicious or careless MCP server can poison the agent's tools.
This MCP security directory rates 27 public MCP servers, derived only from what we observed in the State of MCP Security 2026 probe (2026-10-17): six unauthenticated handshake probes per endpoint, asking each server to negotiate four real protocol eras and two fictional ones. Search, sort, and filter below.
These ratings reflect one unauthenticated probe run on 2026-10-17 — not a certification. They measure negotiation behavior only: whether a server silently downgraded the newest protocol era. A silent downgrade is not a vulnerability finding, and an "N/A — unobservable" rating is not a finding of wrongdoing (those servers answered every probe with HTTP 401, so independent verification is impossible). Ratings can change with the next probe run.
| Server | Vendor | Negotiation behavior (observed) | Rating | Evidence note |
|---|
Click a column header to sort. Ratings use the rubric below — nothing else feeds them.
Run date: 2026-10-17. Tool: open-source mcp-negotiation-prober (MIT) — sends an MCP initialize handshake with protocolVersion set to each of 6 eras (2024-11-05, 2025-03-26, 2025-06-18, 2026-07-28, plus fictional 1999-01-01 and 2037-12-31) and classifies the echoed version. No credentials used; every probe was an unauthenticated handshake. Endpoints were taken from vendors' own published docs. An endpoint was included only if it responded at all (including HTTP 401). Verdicts describe negotiation behavior only — results are reproducible: same tool + same endpoints = same verdicts. Full detail: State of MCP Security 2026.
| A | Honest on all 6 probes — newest era negotiated honestly, fictional eras rejected. None observed in this run. |
| B | Newest era handled honestly — no silent downgrade observed; fictional eras not accepted as valid. (Context7, X Docs public, PMWallets, LPSignal.) |
| C | Partially observable — no downgrade observed, but the weakest honest-answer rate among observable servers (2/6). (OutcomeTick.) |
| F | Silent downgrade observed — asked for the newest era 2026-07-28, answered with older 2025-06-18 without declaring it; fictional eras answered with the default version instead of rejected. (Microsoft Learn, AWS.) |
| N/A | Unobservable — not graded. All 6 probes returned HTTP 401 (OAuth wall), so negotiation behavior cannot be independently verified. This is an instrument gap, not a finding of wrongdoing. |
Grades are recomputed every probe run. A vendor that declares its negotiated version publicly — or opens negotiation to unauthenticated verification — moves up on the next run. Downgrades that are declared are not downgrades we can see, and honesty is the only thing graded here.
Run an MCP server and want it in the next probe? Send the public endpoint URL and a link to your docs — we'll include it in the next unauthenticated run and publish the verdict, whatever it is.
An MCP server can expose powerful tools — file access, code execution, credentials, network calls — to any AI agent connected to it. Key risks include over-permissioned tools, prompt injection through tool descriptions, silent protocol downgrades, and negotiation behavior hidden behind OAuth walls, as our 2026-10-17 probe documented.
Probe its negotiation behavior to check for silent protocol downgrades, review every tool’s permissions and descriptions for injected instructions, verify authentication and scope design, and re-verify after vendor updates. Our open-source mcp-negotiation-prober on GitHub automates the handshake part of that audit.
A minimum checklist: verify the negotiated protocol version per session — not just the requested one — review tool permissions and descriptions, demand version transparency from vendors, pin and log what each tool can touch, and re-run checks after every vendor update. The directory above grades 27 public servers on the first item.