--- title: "What 2,760 MCP servers tell your agent: a read of the official registry. Lazaretto" description: "We connected to a sample of the remote servers in the official MCP registry, read the 34,764 tools they hand an agent, and checked them for tool poisoning. What we found, and what our own first rules got wrong." url: "https://lazaretto.dev/blog/what-2760-mcp-servers-tell-your-agent" --- [Home](https://lazaretto.dev/) / [Blog](https://lazaretto.dev/blog) / 2026-10-20 # What 2,760 MCP servers tell your agent: a read of the official registry We connected to a sample of the remote servers in the official MCP registry, read the 34,764 tools they hand an agent, and checked them for tool poisoning. What we found, and what our own first rules got wrong. On 20 October 2026 the official MCP registry listed about 25,800 remote server endpoints that need no header to reach. We sampled them across distinct domains, connected to each the way any MCP client does (`initialize`, then `tools/list`), and read what came back. We never called a tool. This is what the text an agent receives on connect looks like, and what was in it. ## Who answers In a random sample of 2,500 servers, each on a different domain: - 54% listed their tools to anyone who asked. - 37% wanted credentials before they would say anything. - 8% were down, gone, or not an MCP server at that address. Across that sample and a second one, 2,760 servers handed over their tools: 34,764 tools in all, six per server at the median. ## What they say to the agent 74% of the servers we read also set `instructions`: free text that a client puts in front of the model when the server connects, before the user has asked for anything. One in ten uses shouted directives in its tool text (ALWAYS, NEVER, MUST, IMPORTANT). Nearly all of it is ordinary guidance: call this tool first, ask the user before spending money, do not tell the user a booking went through when it did not. It is also the exact channel a poisoned server uses, which is why it is worth reading. ## What we found None of the 2,760 servers matched the published poisoning patterns: hidden directive blocks, orders to read SSH keys or agent config, parameters built to carry secrets or the conversation out, orders that redirect another server's tools, or invisible characters. One server did trip a rule: a security scanner whose description lists the attack commands it looks for. We count that as a false alarm. That is a snapshot, not a clean bill. 37% of servers would not show us their tools. Servers that run locally over stdio are not in the registry's remote list at all. And a server can change its tools whenever it likes, with no version number to compare. ## What our own rules got wrong The first pass of this read, with the rules we ran this morning, flagged 12% of the servers we could read. We looked at every flag. All of them were honest text: a service asking for its own API key, a schema warning the agent not to send credentials, a server telling the agent not to claim a booking it did not make, a server explaining the order to call its own tools in. A check that warns on one server in eight teaches people to click past it. So the rules now look for the shape of an attack rather than its vocabulary: what is being carried out, whose tool is being ordered about, whether the thing being hidden is the instruction itself. On a second sample of 1,371 servers we never tuned on, the old rules flagged 168 and the new ones flag none. Every published attack in our test set is still caught, and two kinds that were missed before now are: zero-width characters in tool text, and a tool name spoofing another with a look-alike letter. We also found that the scanner was reporting some servers as clean when it had not read their tools at all. A result like that now says plainly that nothing was checked. ## Check a server yourself Paste any remote server's URL into the [free MCP server check](https://lazaretto.dev/check/mcp). It reads the tools the way this survey did and names any rule that fired, without quoting the flagged text. To have the same check run every time Claude Code adds a server, install the free [lazaretto-guard](https://github.com/jamesdfinance-dev/lazaretto-plugins) plugin. A clean read means these rules found nothing, not that a server is harmless: a signal, not a warranty. Lazaretto is the pre-install checkpoint agents call themselves. [Try it](https://lazaretto.dev/#try) · [pricing](https://lazaretto.dev/pricing) · [connect your agent](https://lazaretto.dev/agents). --- Machine-readable index: https://lazaretto.dev/llms.txt. OpenAPI: https://lazaretto.dev/openapi.json. MCP endpoint: https://lazaretto.dev/mcp. Any page on this site is available as markdown by adding .md to its path.