We applied the open-source CuratedMCP Auditor risk model to 29 of the most widely-used MCP servers. Any developer can add them to Claude Code, Cursor, Windsurf or Copilot in under 30 seconds — with no review, audit, or allowlist. That is the shadow-MCP problem, stated as a fact.
Published by CuratedMCP · Reproducible from each server's own install docs
Flags mirror the local CuratedMCP Auditor: credentials in env or args, filesystem access, and publisher provenance. Sorted by risk.
| Server | Publisher | Risk | Flags |
|---|---|---|---|
| Exa Search | community | HIGH | Credential in env, Unverified publisher |
| Perplexity | community | HIGH | Credential in env, Unverified publisher |
| Firecrawl | community | HIGH | Credential in env, Unverified publisher |
| Apify | community | HIGH | Credential in env, Unverified publisher |
| MongoDB | community | HIGH | Credential in env, Unverified publisher |
| AWS (community) | community | HIGH | Credential in env, Unverified publisher |
| Obsidian | community | HIGH | Filesystem access, Unverified publisher |
| Filesystem | official | MEDIUM | Filesystem access |
| GitHub | official | MEDIUM | Credential in env |
| GitLab | official | MEDIUM | Credential in env |
| Google Drive | official | MEDIUM | Credential in env |
| Slack | official | MEDIUM | Credential in env |
| Postgres | official | MEDIUM | Credential in args |
| Google Maps | official | MEDIUM | Credential in env |
| Brave Search | official | MEDIUM | Credential in env |
| Sqlite | official | MEDIUM | Filesystem access |
| Sentry | official | MEDIUM | Credential in args |
| Stripe | vendor | MEDIUM | Credential in env |
| Cloudflare | vendor | MEDIUM | Credential in env |
| Supabase | vendor | MEDIUM | Credential in env |
| Notion | vendor | MEDIUM | Credential in env |
| Linear | vendor | MEDIUM | Credential in env |
| Atlassian | vendor | MEDIUM | Credential in env |
| Desktop Commander | community | LOW | Unverified publisher |
| Shell / iTerm | community | LOW | Unverified publisher |
| Docker | community | LOW | Unverified publisher |
| Puppeteer | official | VERIFIED | — |
| Memory | official | VERIFIED | — |
| Fetch | official | VERIFIED | — |
Methodology: each row reflects the install configuration the server's own README tells you to paste into your AI client — not its source code. Generated by scripts/mcp-security-report.ts.
The 29 servers above are the most popular ones — names you already recognise. To check whether that pattern held more broadly, we looked at the other corpus we have: all 73 servers approved into the CuratedMCP catalog, each read by a human reviewer before listing. Different sample, same shape.
1 / 73
is read-only
Every other server can write, fetch, reach the network, or execute.
74%
reference a credential in their config
52 of the 70 that publish a config example — matching the 69% we found in the popular set.
10 / 73
can execute shell commands
About one in seven. 13 request access to stored credentials.
Methodology: risk level and capability flags are assigned during the human review each server passes before it is listed. The credential figure is derived by pattern-matching the server's own published config example for key/token/secret/password fields — the same surface a developer would paste into their AI client. Two independent samples, drawn differently, landing within five points of each other is the part worth noting.
The same audit, run locally against your real config. It finds every MCP server installed across Claude Code, Cursor, Windsurf and Copilot, and flags credential exposure and filesystem grants. No install, no signup, nothing leaves your machine.
If several engineers are installing MCP servers across different AI clients, you have shadow MCP. CuratedMCP gives platform and AppSec teams one allowlist, one audit log, and local-first enforcement across every client — so you can say yes safely. Get the full report and a teardown of how to govern it.
See the control planeThe data, the methodology, and a governance teardown. High-signal only.