We analyzed 12,700 MCP servers: here's what we found

The public catalog Centinela watches now has 12,707 MCP servers and 127,302 tools cataloged across all of them. This isn't a sample or a survey — it's every server we've been able to locate, scanned every 24 hours, with the numbers below pulled straight from our database today.

We wanted to share a first cut of what we've found. None of this is generic "AI is dangerous" alarmism — these are concrete findings, each with its own number, about real servers any agent could be using right now.

Overall health

Of the servers we've been able to scan successfully, most are healthy: 6,296 have nothing above low severity. But 890 have something worth reviewing (medium severity) and 144 have a confirmed or very-high-confidence finding — what the Board calls "Threat."

Two more numbers that aren't good or bad on their own, but matter: 3,333 servers require authentication (we can't see inside without credentials) and 2,044 simply don't respond. Neither counts as "safe" — it's the opposite: we have no visibility, so we don't know what's inside.

What stood out most

• 7,546 findings of servers with no authentication at all — by far the most common, and not necessarily bad: many read-only public APIs don't need it.
• 5,220 findings of "tool changed," spread across 1,369 servers — a tool you already knew changed its description between one scan and the next. This is the central signal of what we call a rug pull: you trust a tool, and later it changes without anyone telling you.
• 2,267 findings (848 servers) of tools asking for more access — files, commands, credentials — than their own description lets on.
• 231 tools (across just 13 servers) with a schema open to any additional field, unrestricted — they accept JSON that was never advertised.
• 29 tools with a name suspiciously close to a widely trusted one (reading a file, running a command) — what's known as tool shadowing, which we cover in detail in the dedicated article.

Why we're sharing this

None of these numbers is an accusation against any specific server — most low- or medium-severity findings are informational, not confirmation that something is wrong. What we do want to make clear is the scale: with 12,700 servers and growing, no team can review this by hand, and an AI agent certainly won't do it on its own before using a tool.

You can see the live, always-current status on the Board. And if you want to watch your own MCP servers — the ones you use or the ones you run — you can start for free in a couple of minutes.