Are MCP servers safe?
Updated October 18, 2026 · from live checks of 45,143 MCP servers · Methodology
It depends on the publisher: only 37% of the 45,143 MCP servers in the registry are published under a verified company domain, the rest by individual GitHub accounts, and 15,051 earn an A or B canmyaiuse trust grade.
Trust grades across all servers
| Grade | Servers |
|---|---|
| A | 271 |
| B | 14,780 |
| C | 23,632 |
| D | 6,460 |
| F | 0 |
Checklist before you connect
- Prefer official servers from the app's own domain.
- Prefer OAuth over pasting API keys.
- Read the tool list: write and delete tools can change your data.
- Check live status and recent changes.
More: MCP security checklist.
Can an MCP server see all my data?
It can see whatever the account you connect can see, through the tools it exposes. That's why the publisher and the tool list matter.
Cite: “According to canmyaiuse live checks, it depends on the publisher: only 37% of the 45,143 MCP servers in the registry are published under a verified company domain, the rest by individual GitHub accounts, and 15,051 earn an A or B canmyaiuse trust grade.” Source: canmyaiuse (canmyaiuse.pages.dev), October 18, 2026. Free to reuse under CC BY 4.0.