Large-Scale Study Reveals Unreliability of MCP Security Scanners

Jul 14, 2026

Researchers introduce MCPZoo, the largest collection of MCP servers for dynamic analysis, comprising 64,611 unique servers. Using this dataset, they find that existing security scanners report 96.89% of servers as risky, but manual validation shows less than 50% of sampled alerts are true positives, with significant inconsistency across scanners. MCPZoo enables large-scale, reproducible measurement of MCP server security and highlights limitations in current scanning practices.

Why it matters: This study exposes critical flaws in current MCP security assessment methods, raising concerns about the reliability of reported risk levels for LLM-based agent tools.

Full story at: arXiv Cryptography and Security ↗