A census, not a verdict · enumerated 17 September 2026 · 33,033 servers · method published
What this is. A census, not a verdict. We enumerated every record in the official Model Context Protocol registry and counted what is there. No server on this page is called malicious, and nothing here is an estimate — every figure is counted from the registry's own published records, by a script, not typed by hand.
The registry returned 107,062 version records, which resolve to 33,033 distinct servers once you keep only the latest version of each. 1,271 version records are marked deprecated.
A server record may declare the repository its code lives in. Nearly a quarter do not.
| Provenance | Servers | Share |
|---|---|---|
| Declares a GitHub repository | 25,381 | 76.8% |
| Declares no repository at all | 7,613 | 23.0% |
| Declares a repository that is not on GitHub | 39 | 0.1% |
Those 25,381 servers resolve to 20,379 distinct repositories — so several thousand servers share a repository with at least one other server. That matters below.
The registry's own schema separates a package you install from a remote URL you call. Most of the registry is the second kind: you are trusting an endpoint, not inspecting an implementation.
| What the record offers | Servers |
|---|---|
| A remote URL only — nothing to inspect | 18,758 |
| An installable package only | 12,254 |
| Both | 1,589 |
| Neither — nothing to install and nothing to call | 432 |
The median namespace publishes one server, and 17,462 namespaces publish exactly one. Thirteen namespaces publish a hundred or more.
| Publishers | Servers | Share of the registry |
|---|---|---|
| Largest namespace | 2,269 | 6.9% |
| Top 3 namespaces | 4,971 | 15.0% |
| Top 10 | 6,412 | 19.4% |
| Top 25 | 7,602 | 23.0% |
| Top 100 | 9,642 | 29.2% |
The sharpest number in the dataset is servers per distinct repository within a single namespace. The highest is 375 servers backed by one repository. The largest publisher on the registry has 2,269 servers behind 9 repositories — about 252 servers per repository.
Say this precisely. Bulk registration is not a vulnerability, and a monorepo of connectors is an ordinary, legitimate pattern. The finding is narrower and it stands on its own: the registry's own metadata cannot distinguish 375 independent servers from one repository registered 375 times — and neither can a person browsing it. We publish the distribution, not the account names.
We expected to find some. We looked for the 7,600 repositories attributed to the FakeGit campaign among the 20,379 repositories behind registry servers.
| Comparison | Count |
|---|---|
| Registry repositories compared | 20,379 |
| Attributed FakeGit repositories | 7,600 |
| Repositories in both sets | 0 |
| GitHub accounts in both sets | 0 |
Not a small overlap. Not one repository and not one account. The fake AI skills and MCP servers counted in that campaign were distributed through directories and chat surfaces, not through the protocol's own registry. We publish this because it is what the measurement says, and because we had written a different headline before we ran it.
For an MCP server, the instrument RepoGates brings is the repository behind it. Against this registry that reaches at most 76.8% of servers, and in practice fewer — a package that points at a monorepo shared by hundreds of listings is not a repository anyone has vetted. For 23.0% there is no repository to assess at all, and for the 56.8% that are remote-only there is no code in the picture.
So repository scoring is the wrong primary instrument for MCP. The one that does apply is C22 — where the recommendation came from. The MCP directories and AI chat surfaces a person follows a link from are in the browser, the one place a browser extension can see, and they are where that campaign's imposters were found.
Enumerated from the registry's public /v0/servers endpoint by cursor pagination, keeping the latest version record per server name. Counts derived by a second script from that enumeration, so no figure on this page was typed by hand. The endpoint is public, so anyone who pages through it the same way can repeat the census; it takes about nine minutes. The raw 112 MB snapshot is not published — it is a copy of someone else's index, and the enumeration regenerates it.
Limitations. This is the official registry only — not third-party directories, which hold different and overlapping sets. It is one point in time, 17 September 2026, and the registry grows daily. A namespace is the registry's own naming, which need not correspond to one operator. Nothing here inspects any server's behaviour; no server was installed, called or scored for this page.
A census counts what a registry's records say; it is never a claim
about what any server does. RepoGates gates browser downloads —
Download ZIP, release assets, Save-Link-As. It does not see
git clone, package managers or curl — outside
Claude Code with the RepoGates plugin, whose hook refuses a clone or
install that names a blocked repository on the command line, before it
runs. The hook sees Bash tool calls in that one client and nothing
else, and a call an agent makes to a remote MCP server is not one of
them.