MCP servers in the official registry

The shape. An MCP server is a tool your AI agent calls. A local one is a package your client downloads and runs on your machine, with your permissions; a remote one runs on its operator's machine and receives whatever your agent sends it. The official MCP registry verifies who published a listing — a GitHub sign-in or a DNS record — and checks the listing's format. It does not review the server's code, the package it launches or what the server does once it runs. A listing can point at a repository its publisher does not control, launch a package at whatever version is newest, or pipe a download into a shell. This page is a threat model and a measurement, not a campaign list: it names no server, publisher or repository. For the registry as a whole, see the MCP registry, counted.

What RepoGates checks on a server

Ten checks, read from the registry's own record and never from the server's code (the list):

M1 Registry status and M9 Listing age: what the registry says about the listing, and how long it has been there.
M2 Namespace: who the registry verified, and whether a GitHub-verified listing declares a repository of another owner.
M3 Source repository and M4 Launched package: the declared repository through the 22 GitHub checks and each npm or PyPI package through the 12 package checks, their verdicts riding along. A BLOCK source or package makes the server BLOCK, with the action a clone or an install of it gets.
M5 Remote endpoint: a remote-only server is REVIEW at best, never a pass; plain http is a high finding.
M6 Version pinning, M7 Secrets requested and M8 Launch arguments: what the client is told to run, and what it is asked to hand over.
M10 AI-agent provenance: decided in the browser; not observed for a registry listing today.

Measured on 1 November 2026

Two samples from the official registry, each read live through the product's own checks: every server that 24 well-known software vendors publish under their own namespaces (45 servers), and 150 servers drawn at random with a fixed seed (20261101) from the rest.

Sample	Servers	PASS	REVIEW	BLOCK	Median time
Vendors' own namespaces	45	9	36	0	1.4 s
Random, seed 20261101	150	48	95	7	1.1 s

Why so many REVIEWs. Of the 131 REVIEWs, 106 are remote-only servers: REVIEW by decision, because what runs on the operator's machine cannot be read from a listing. Another 21 launch a package RepoGates does not assess — an OCI image, an MCPB bundle, a NuGet package, or more than three packages — which is “not assessed”, never a pass. The other 4 are a new listing with no source repository, a namespace that declares another owner's repository, or a deprecated listing. A REVIEW here is mostly a statement about what could be read, not about the vendor.

The seven BLOCKs, all in the random sample, are each the declared source repository's own BLOCK under the 22 checks, riding along: in every one, the repository's owner's account is under 90 days old, the provenance signal the FakeGit campaign left. That is the verdict a git clone of that repository gets. It is a provenance signal, not proof of malice, and none of these figures is a catch rate. Five rows are partial scans: a launched package or a source repository was not read in time, and the check that needed it is listed as not checked.

What fired, by check

Check	Vendors	Random
M1 Registry status	0	1
M2 Namespace	0	3
M3 Source repository	1	33
M4 Launched package	12	13
M5 Remote endpoint	24	85
M6 Version pinning	1	0
M7 Secrets requested	0	0
M8 Launch arguments	0	0
M9 Listing age	0	4
M10 AI-agent provenance	not checked	not checked

Servers on which the check was a finding (medium or above); a note is not counted. The rows are in the repository as docs/45-mcpr-rows-2026-11-01.jsonl.

Where it runs

The verdict is served on the API (/v1/mcpr/score/{namespace}/{name}) and through the MCP server (platform="mcpr"). In Claude Code with the RepoGates plugin, a claude mcp add line with a remote address is matched to the listings that declare it: their verdict rides along and the line is still an ask, because anyone may declare any address and the server runs on its operator's machine; a listing whose verdict is BLOCK is denied. An address no listed server declares is asked about. A local server added with claude mcp add srv -- npx -y pkg is judged as the package it starts. There is no board on the registry's own pages.

What RepoGates does not see

It does not see git clone, package managers or curl — outside Claude Code with the RepoGates plugin, whose hook refuses a clone or install that names a blocked repository on the command line, before it runs. The hook sees Bash tool calls in that one client and nothing else. Edit and Write are read for one thing only — an API key about to be saved — checked on the machine and never sent; that guard asks, it never denies. A server added by editing a configuration file or through /mcp is not a shell line the hook sees. It does not read a server's code or what the server does once it runs. The registry carries no download count, star count or popularity of any kind, so there is no lookalike check. A PASS means nothing matched on what was read; it is not an audit.

Add RepoGates to Chrome or Edge The Claude Code plugin