A census, not a verdict · enumerated 5–6 October 2026 · 39,653 servers · method published
What this is. A census, not a verdict. We enumerated every record in the official Model Context Protocol registry and counted what is there. No server on this page is called malicious, and nothing here is an estimate — every figure is counted from the registry's own published records, by a script, not typed by hand.
The registry returned 134,056 version records, which resolve to 39,653 distinct servers once you keep only the latest version of each. 2,313 version records are marked deprecated.
A server record may declare the repository its code lives in. More than a quarter do not.
| Provenance | Servers | Share |
|---|---|---|
| Declares a GitHub repository | 28,911 | 72.9% |
| Declares no repository at all | 10,694 | 27.0% |
| Declares a repository that is not on GitHub | 48 | 0.1% |
Those 28,911 servers resolve to 23,309 distinct repositories — so several thousand servers share a repository with at least one other server. That matters below.
The registry's own schema separates a package you install from a remote URL you call. Most of the registry is the second kind: you are trusting an endpoint, not inspecting an implementation.
| What the record offers | Servers |
|---|---|
| A remote URL only — nothing to inspect | 22,876 |
| An installable package only | 14,339 |
| Both | 1,959 |
| Neither — nothing to install and nothing to call | 479 |
The median namespace publishes one server, and 21,192 namespaces publish exactly one. Seventeen namespaces publish a hundred or more.
| Publishers | Servers | Share of the registry |
|---|---|---|
| Largest namespace | 2,365 | 6.0% |
| Top 3 namespaces | 5,195 | 13.1% |
| Top 10 | 7,486 | 18.9% |
| Top 25 | 8,919 | 22.5% |
| Top 100 | 11,180 | 28.2% |
The sharpest number in the dataset is servers per distinct repository within a single namespace. The highest is 375 servers backed by one repository. The largest publisher on the registry has 2,365 servers behind 9 repositories — about 263 servers per repository.
Say this precisely. Bulk registration is not a vulnerability, and a monorepo of connectors is an ordinary, legitimate pattern. The finding is narrower and it stands on its own: the registry's own metadata cannot distinguish 375 independent servers from one repository registered 375 times — and neither can a person browsing it. We publish the distribution, not the account names.
We expected to find some. We looked for the 7,600 repositories attributed to the FakeGit campaign among the 23,309 repositories behind registry servers.
| Comparison | Count |
|---|---|
| Registry repositories compared | 23,309 |
| Attributed FakeGit repositories | 7,600 |
| Repositories in both sets | 0 |
| GitHub accounts in both sets | 0 |
Not a small overlap. Not one repository and not one account. The fake AI skills and MCP servers counted in that campaign were distributed through directories and chat surfaces, not through the protocol's own registry. We publish this because it is what the measurement says, and because we had written a different headline before we ran it.
For an MCP server, the instrument RepoGates brings is the repository behind it. Against this registry that reaches at most 72.9% of servers, and in practice fewer — a package that points at a monorepo shared by hundreds of listings is not a repository anyone has vetted. For 27.0% there is no repository to assess at all, and for the 57.7% that are remote-only there is no code in the picture.
So repository scoring is the wrong primary instrument for MCP. The one that does apply is C22 — where the recommendation came from. The MCP directories and AI chat surfaces a person follows a link from are in the browser, the one place a browser extension can see, and they are where that campaign's imposters were found.
For what a malicious MCP server can do, how one reaches you and six checks to make before adding one, read What is a malicious MCP server?
Enumerated from the registry's public /v0/servers endpoint by cursor pagination, keeping the latest version record per server name. Counts derived by a second script from that enumeration, so no figure on this page was typed by hand. The endpoint is public, so anyone who pages through it the same way can repeat the census. It took about nine minutes on 17 September and several hours on 5–6 October, when the registry answered pages deep in its list in up to a minute each. The raw 144 MB snapshot is not published — it is a copy of someone else's index, and the enumeration regenerates it.
Limitations. This is the official registry only — not third-party directories, which hold different and overlapping sets. It is one point in time, 5–6 October 2026: the enumeration was paused overnight, so records up to the server name io.github.discourse/mcp were read on 5 October and the rest on 6 October. The registry grows daily; on 17 September it held 33,033 servers. A namespace is the registry's own naming, which need not correspond to one operator. Nothing here inspects any server's behaviour; no server was installed, called or scored for this page.
A census counts what a registry's records say; it is never a claim
about what any server does. RepoGates gates browser downloads —
Download ZIP, release assets, Save-Link-As. It does not see
git clone, package managers or curl — outside
Claude Code with the RepoGates plugin, whose hook refuses a clone or
install that names a blocked repository on the command line, before it
runs. The hook sees Bash tool calls in that one client and nothing
else, and a call an agent makes to a remote MCP server is not one of
them. Edit and Write are read for one thing only — an API key about to be saved — checked on the machine and never sent; that guard asks, it never denies.