MCP Server Security Leaderboard

264 of 277 public MCP servers audited on 2026-11-11. Passive checks only (OAuth metadata, response headers, manifest drift). No tool calls, no OAuth flows against third-party servers.

A220
B30
C9
D3
F2
#HostGradeScoreFindingsCategory
1developers.google.comA1000public-by-design
2fixragent.comA1000public-by-design
3livescoremcp.comA1000public-by-design
4api.tally.soA991oauth-protected
5circleback.aiA991oauth-protected
6mcp.asana.comA991oauth-protected
7mcp.close.comA991oauth-protected
8mcp.pipeboard.coA991oauth-protected
9ramp-mcp-remote.ramp.comA991oauth-protected
10ademe-opendata--koumoul.run.toolsA951oauth-protected
11agent-registry--agentry.run.toolsA951oauth-protected
12agent-utils--aparajithn.run.toolsA951oauth-protected
13agentecon--heavysword1.run.toolsA951oauth-protected
14ai.todoist.netA951oauth-protected
15aiwyn.run.toolsA951oauth-protected
16api-ia-qa.run.toolsA951oauth-protected
17arxiv-scout--shawnnygoh.run.toolsA951oauth-protected
18atom-mcp-server--a7om.run.toolsA951oauth-protected
19authorprofilemcp--alperenkocyigit.run.toolsA951oauth-protected
20aws-knowledge-mcp--faresyoussef94.run.toolsA951oauth-protected
21backtesting-arena--info-6d0w.run.toolsA951oauth-protected
22bgpt.proA951public-by-design
23bgpt.proA951public-by-design
24bigquery.run.toolsA951oauth-protected
25blockchain-basic--boar-network.run.toolsA951oauth-protected
26brave.run.toolsA951oauth-protected
27cap-rate-signals--capratesignals.run.toolsA951oauth-protected
28cityparity--bissell-skyler.run.toolsA951oauth-protected
29coinrailz-mcp--travis-kellogg1.run.toolsA951oauth-protected
30colour-memory-api.run.toolsA951oauth-protected
31commerce--lmktoday.run.toolsA951oauth-protected
32compliancecheckup--friso.run.toolsA951oauth-protected
33corpus--listentosadhu.run.toolsA951oauth-protected
34cultural-intelligence--sincetomorrow.run.toolsA951oauth-protected
35d3vtools.run.toolsA951oauth-protected
36data--autario.run.toolsA951oauth-protected
37defi-intel--defibabylon.run.toolsA951oauth-protected
38delx-mcp--delx.run.toolsA951oauth-protected
39devmatch--zachary-royals.run.toolsA951oauth-protected
40discourse-forum-mcp--king-of-the-grackles.run.toolsA951oauth-protected
41docs--secureship.run.toolsA951oauth-protected
42dominion-observatory--vdineshk.run.toolsA951oauth-protected
43doorvault--cavasotti.run.toolsA951oauth-protected
44emblem-mcp--emblemai.run.toolsA951oauth-protected
45entity-verification--entia.run.toolsA951oauth-protected
46exa.run.toolsA951oauth-protected
47favcrm--favcrm.run.toolsA951oauth-protected
48federal-regulations-mcp-server--cyanheads.run.toolsA951oauth-protected
49ferryhopper.github.ioA951public-by-design
50finance-mcp-server--nexgendata-apify.run.toolsA951oauth-protected
51fortuneteller--hjsh200219.run.toolsA951oauth-protected
52framesail--framesail.run.toolsA951oauth-protected
53gapup-mcp--mehdi-sakalypr.run.toolsA951oauth-protected
54gateway--pipeworx.run.toolsA951oauth-protected
55geppetto-robot-directory--hello-oipe.run.toolsA951oauth-protected
56github-mcp-server--nexgendata-apify.run.toolsA951oauth-protected
57github.run.toolsA951oauth-protected
58gitmcp.ioA951public-by-design
59gitmcp.ioA951public-by-design
60gmail.run.toolsA951oauth-protected
61google-maps-mcp-server--nexgendata-apify.run.toolsA951oauth-protected
62googlecalendar.run.toolsA951oauth-protected
63googledrive.run.toolsA951oauth-protected
64googlesheets.run.toolsA951oauth-protected
65govbase--govbase.run.toolsA951oauth-protected
66gread--nitrofire-q.run.toolsA951oauth-protected
67hivecast-x711--ramboweb3.run.toolsA951oauth-protected
68hsk-mcp--kuibin-dev.run.toolsA951oauth-protected
69ibanforge--cammac.run.toolsA951oauth-protected
70ignav-flights--gordgus.run.toolsA951oauth-protected
71imf.caseyjhand.comA951public-by-design
72industrylens.run.toolsA951oauth-protected
73iwant--iwantfyi.run.toolsA951oauth-protected
74jiebang-tools--ajie-jiebang.run.toolsA951oauth-protected
75ko-financial-data--fenglucc.run.toolsA951oauth-protected
76korean-crypto-mcp--koreafintech.run.toolsA951oauth-protected
77lad-lviv-ua--vbhjckfd.run.toolsA951oauth-protected
78legal-mcp-server--nexgendata-apify.run.toolsA951oauth-protected
79llm-orchestration-agent--a2a.run.toolsA951oauth-protected
80math-mcp--ethanhenrickson.run.toolsA951oauth-protected
81mcp-malaysiatransit--hithereiamaliff.run.toolsA951oauth-protected
82mcp-server--dev-7bd0.run.toolsA951oauth-protected
83mcp-server--quelvio.run.toolsA951oauth-protected
84mcp-server--voidly.run.toolsA951oauth-protected
85mcp.apify.comA951oauth-protected
86mcp.clickup.comA951oauth-protected
87mcp.dappier.comA951public-by-design
88mcp.deepwiki.comA951public-by-design
89mcp.dodopayments.comA951oauth-protected
90mcp.figma.comA951oauth-protected
91mcp.gamma.appA951oauth-protected
92mcp.globalping.devA951oauth-protected
93mcp.granola.aiA951oauth-protected
94mcp.invideo.ioA951oauth-protected
95mcp.linear.appA951oauth-protected
96mcp.monday.comA951oauth-protected
97mcp.morningstar.comA951oauth-protected
98mcp.neon.techA951oauth-protected
99mcp.notion.comA951oauth-protected
100mcp.notion.comA951oauth-protected
101mcp.otter.aiA951oauth-protected
102mcp.turkishtechlab.comA951oauth-protected
103mcpsemanticscholar--hamid-vakilzadeh.run.toolsA951oauth-protected
104memxus--memxus.run.toolsA951oauth-protected
105menjometre--segellfosc-dev-ayfx.run.toolsA951oauth-protected
106metro-mcp.anuragd.meA951public-by-design
107metro-mcp.anuragd.meA951public-by-design
108moodtrip-hotel-search--moodtrip.run.toolsA951oauth-protected
109mtg-mcp-server--j4th.run.toolsA951oauth-protected
110national-weather-service--smithery-ai.run.toolsA951oauth-protected
111nausika.run.toolsA951oauth-protected
112news--google.run.toolsA951oauth-protected
113news--theagenttimes.run.toolsA951oauth-protected
114nexus-intelligence--rileycraig14.run.toolsA951oauth-protected
115nist-nvd-mcp-server--cyanheads.run.toolsA951oauth-protected
116npm-sentinel-mcp--nekzus.run.toolsA951oauth-protected
117nutribalance-mcp--nutribalance.run.toolsA951oauth-protected
118onesignal.run.toolsA951oauth-protected
119openalex-mcp-server--cyanheads.run.toolsA951oauth-protected
120orcid-mcp-server--cyanheads.run.toolsA951oauth-protected
121panko-food-safety--alex-kenny-lee-vfjv.run.toolsA951oauth-protected
122paper-search-mcp-openai--adamamer20.run.toolsA951oauth-protected
123paper-search-mcp-openai-v2--titansneaker.run.toolsA951oauth-protected
124pinescript--bouch.run.toolsA951oauth-protected
125pipeworx--pipeworx.run.toolsA951oauth-protected
126polymarket-mcp--aryankeluskar.run.toolsA951oauth-protected
127polymarketscan--jordan-s648.run.toolsA951oauth-protected
128primitive.run.toolsA951oauth-protected
129protein-mcp-server--cyanheads.run.toolsA951oauth-protected
130pubmed-mcp-server--cyanheads.run.toolsA951oauth-protected
131pubmed.run.toolsA951oauth-protected
132redfin-mcp-server--nexgendata-apify.run.toolsA951oauth-protected
133reliefweb-mcp-server--cyanheads.run.toolsA951oauth-protected
134remote-mcp.comA951public-by-design
135resultrail--larrybuildsai.run.toolsA951oauth-protected
136revnuvo.run.toolsA951oauth-protected
137ris-austria-mcp-server--cyanheads.run.toolsA951oauth-protected
138romulus-31780--openclaw-hal9000.run.toolsA951oauth-protected
139sap-mcp--oobe-protocol.run.toolsA951oauth-protected
140search--naver.run.toolsA951oauth-protected
141shirabe-calendar--r-yoshikawa.run.toolsA951oauth-protected
142slack.run.toolsA951oauth-protected
143sms-marketing--oblipali.run.toolsA951oauth-protected
144social-superpowers.run.toolsA951oauth-protected
145sparkforge--henry-ships.run.toolsA951oauth-protected
146speclock--sgroy10.run.toolsA951oauth-protected
147steadyfetch--intake-triage.run.toolsA951oauth-protected
148subwayinfo.run.toolsA951oauth-protected
149synmerco--joelasota.run.toolsA951oauth-protected
150talao--thierrythevenet.run.toolsA951oauth-protected
151thinkzone--ahmed2real.run.toolsA951oauth-protected
152tls-radar--slmusayev.run.toolsA951oauth-protected
153tracepass-mcp-server--malinoto.run.toolsA951oauth-protected
154tulugar-real-estate--jan-krat-kj4q.run.toolsA951oauth-protected
155uk-due-diligence--bouch.run.toolsA951oauth-protected
156unclick--creativelead.run.toolsA951oauth-protected
157url-safety-validator-mcp--ojaskord.run.toolsA951oauth-protected
158vibe-pay--xqb.run.toolsA951oauth-protected
159virtualsms-mcp--virtualsms.run.toolsA951oauth-protected
160vivaldo-product-discovery--vivaldoeuropes.run.toolsA951oauth-protected
161waystation.aiA951public-by-design
162web-scout-mcp--pinkpixel-dev.run.toolsA951oauth-protected
163whatdotheyknow--bouch.run.toolsA951oauth-protected
164who-gho-mcp-server--cyanheads.run.toolsA951oauth-protected
165wikipedia-mcp-server--cyanheads.run.toolsA951oauth-protected
166witness-protocol--delx.run.toolsA951oauth-protected
167worldmonitor.run.toolsA951oauth-protected
168www.javadocs.devA951public-by-design
169www.polarsignals.comA951public-by-design
170www.remote-mcp.comA951public-by-design
171www.searchapi.ioA951oauth-protected
172xpoz--net-service.run.toolsA951oauth-protected
173your-echo-agent---pinksaltlamp75.run.toolsA951oauth-protected
174youtube-mcp--sfiorini.run.toolsA951oauth-protected
175zipp--deficlow.run.toolsA951oauth-protected
176agenttools.wolfram.comA942public-by-design
177api.fathom.aiA942oauth-protected
178api.findadomain.devA942public-by-design
179api.manifold.marketsA942public-by-design
180api.polarsignals.comA942oauth-protected
181asset-management.mcp.cloudinary.comA942oauth-protected
182compute.googleapis.comA942public-by-design
183game.spacemolt.comA942public-by-design
184hf.coA942oauth-protected
185knowledge-mcp.global.api.awsA942public-by-design
186mcp-server.egnyte.comA942oauth-protected
187mcp.airtable.comA942oauth-protected
188mcp.attio.comA942oauth-protected
189mcp.buildkite.comA942oauth-protected
190mcp.canva.comA942oauth-protected
191mcp.deepwiki.comA942public-by-design
192mcp.docs.astro.buildA942public-by-design
193mcp.ferryhopper.comA942public-by-design
194mcp.instantdb.comA942oauth-protected
195mcp.jam.devA942oauth-protected
196mcp.openzeppelin.comA942public-by-design
197mcp.openzeppelin.comA942public-by-design
198mcp.openzeppelin.comA942public-by-design
199mcp.openzeppelin.comA942public-by-design
200mcp.remote-mcp.comA942public-by-design
201mcp.semgrep.aiA942oauth-protected
202mcp.semgrep.aiA942oauth-protected
203mcp.squareup.comA942oauth-protected
204mcp.tldv.ioA942oauth-protected
205mcp.webflow.comA942oauth-protected
206mcp.wix.comA942oauth-protected
207netlify-mcp.netlify.appA942oauth-protected
208search-mcp.parallel.aiA942oauth-protected
209subwayinfo.nycA942public-by-design
210task-mcp.parallel.aiA942oauth-protected
211webzum.comA942public-by-design
212www.ean-search.orgA942oauth-protected
213www.zine.aiA942oauth-protected
214api.fireflies.aiA902oauth-protected
215mcp.mercadolibre.comA902oauth-protected
216mcp.mercadopago.comA902oauth-protected
217mcp.intercom.comA893oauth-protected
218mcp.paypal.comA893oauth-protected
219www.context-awesome.comA893public-by-design
220api.read.aiA851oauth-protected
221hiveintelligence.xyzB842oauth-protected
222bigquery.googleapis.comB835public-by-design
223container.googleapis.comB835public-by-design
224mapstools.googleapis.comB835public-by-design
225api.dashboard.plaid.comB802oauth-protected
226bindings.mcp.cloudflare.comB802oauth-protected
227mcp.cortex.ioB802oauth-protected
228mcp.indeed.comB802oauth-protected
229mcp.octagonagents.comB802oauth-protected
230mcp.sentry.devB802oauth-protected
231mcp.sentry.devB802oauth-protected
232mcp.simplescraper.ioB802oauth-protected
233mcp.supabase.comB802oauth-protected
234observability.mcp.cloudflare.comB802oauth-protected
235remotemcp.substack.comB802oauth-protected
236www.mypromind.comB802oauth-protected
237agent.thoughtspot.appB793oauth-protected
238getdialer.appB793oauth-protected
239mcp.exa.aiB793oauth-protected
240mcp.listenetic.comB793oauth-protected
241mcp.prisma.ioB793oauth-protected
242mcp.slack.comB793oauth-protected
243mcp.stytch.devB793oauth-protected
244mcp.zapier.comB793oauth-protected
245rag-mcp-2.whatsmcp.workers.devB793oauth-protected
246scorecard-mcp.dare-d5b.workers.devB793oauth-protected
247api.githubcopilot.comB753oauth-protected
248api.githubcopilot.comB753oauth-protected
249crashstory.comB753oauth-protected
250mcp.sentry.ioB753oauth-protected
251mcp.atlassian.comC744oauth-protected
252mcp.context7.comC744oauth-protected
253www.reddit.comC702oauth-protected
254api.telnyx.comC686oauth-protected
255mcp.resemble.aiC652public-by-design
256app.hubspot.comC644oauth-protected
257chainflip-broker.ioC643public-by-design
258mcp.zoom.usC644oauth-protected
259zip1.ioC643public-by-design
260ai-assistant.short.ioD595oauth-protected
261www.bamboosnow.coD534oauth-protected
262mcp.tweetsave.orgD495oauth-protected
263mcp.roundtable.nowF336oauth-protected
264vibemarketing.ninjaF336oauth-protected
13 host(s) unreachable on 2026-11-11 — not scored

Methodology