Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11BackBond says 33% of 7,749 publicly reachable MCP tool manifests matched at least one high-severity rule in its August 2026 scan. That is a vendor-reported match against saved tool metadata—not evidence that a server is vulnerable, has been exploited, or behaves as its description claims.
What the scan included
In an article published in October 2026, BackBond says it queried public-registry endpoints that answered without authentication on August 31, 2026. It reports collecting 8,147 reachable endpoints, which yielded 7,749 distinct manifests and 130,322 tool definitions. The company saved the endpoints’ tools/list responses; it says it neither ran server code nor invoked tools. BackBond’s scan report
As an Amazon Associate I earn from qualifying purchases.
The collection therefore describes one reachable snapshot, not every MCP server or every version of a server in the wider ecosystem. BackBond also says TLS verification was disabled during collection, so it cannot vouch for the authenticity of every endpoint.
Recommended Free Tools
How to read the 33% result
Using Agent Scan 0.6.3 with ruleset 2.0.2, BackBond classified 28% of the manifests as having no blocking finding, 39% as needing review, and 33% as matching at least one high-severity rule that its pre-attachment gate would block. Those percentages describe the scanner’s categories for this corpus and version—not confirmed security outcomes. BackBond’s scan report
#1 Best Overall
A block means a fixed-rule match in metadata. It does not establish a vulnerability, an incident, exploitation, or that the server implements the behavior implied by its tool descriptions. The result is best treated as a signal to inspect a manifest and decide what policy to apply, rather than as a verdict on a server.
Which metadata patterns appeared most often
BackBond’s reported high-severity patterns center on what tools can reach or do, and how they combine. The percentages below are the company’s reported rule matches across manifests; they are not independently verified prevalence estimates. BackBond’s scan report BackBond’s scan report
- Arbitrary URL-like destinations without a schema allowlist — 27%. The reported pattern concerns tools whose metadata indicates network destinations without an allowlist in the input schema.
- Fetch-shaped and destructive or privileged tools in the same manifest — 22%. This is a combination of capabilities, not a claim that one tool necessarily invokes another.
- Persistent-write tools that can accept untrusted content — 21%. The concern is that tool metadata allows externally supplied content to be written persistently.
- Untrusted input reaching a shell or code executor — 3.5%. This was a separate, less frequent reported pattern.
These categories indicate what the rules inferred from descriptions and schemas. They do not show that a tool was called, that its inputs were accepted at runtime, or that any resulting action occurred.
Prompt-steering language was less common in this scan
BackBond says 91 manifests (1.2%) contained descriptions that tried to steer the model, and 10 contained language explicitly forcing invocation. In the company’s reported results, those description patterns were less common than network access, tool combinations, and persistent writes. That is a comparison within this scan, not a finding about MCP manifests generally. BackBond’s scan report
Rank #3
Why a manifest is not a full security picture
BackBond reports that 68% of manifests were only partially analyzable from static metadata, while 10% had at least one tool without an input schema. A description or schema can suggest a capability, but metadata alone cannot establish the server’s implementation, runtime controls, or actual behavior. The reported block rate therefore reflects both the scanner’s rules and the limited evidence available in the manifests. BackBond’s scan report
The rate also changed when the scanner rules changed, even though BackBond says the same files were used:
| Scanner version | Reported blocks on the same files | What this means |
|---|---|---|
| 0.5.15 | 3,477 | BackBond’s reported block count with this version |
| 0.6.x | 2,532 | BackBond’s reported block count after rules were tightened |
These are counts from BackBond’s comparison, not rates for all MCP servers. The difference is a reminder that a scanner result depends on the version and ruleset; a count should not be quoted without that context. BackBond’s scan report
Larger manifests had higher reported block rates
BackBond reports a 13% block rate among manifests with five or fewer tools, compared with 85% among manifests with more than 25 tools. The median manifest contained seven tools; the largest contained 1,082. These figures describe an association in this scan, not proof that adding tools causes unsafe behavior. A larger manifest gives rules more tool descriptions and capability combinations to match. BackBond’s scan report
Best Value
What to check before attaching an MCP server
A metadata scan can help identify questions to investigate, but the result should not replace a review of the server and its permissions. Before attachment, use the manifest as a starting point:
Quick Recap
- Inspect URL-like inputs and determine whether the destinations can be constrained to an allowlist.
- Review fetch, persistent-write, destructive, privileged, shell, and code-execution tools together, rather than evaluating each description in isolation.
- Check whether inputs that could originate outside the server are passed to write or execution tools, and what controls constrain that path.
- Look for missing input schemas or descriptions that leave a tool’s inputs and intended effects unclear.
- Verify behavior and access controls through code review or appropriate testing; a metadata match alone cannot confirm what happens at runtime.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
