What PlugVet's automated checks find most often in MCP servers, skills and plugins

Summary: We ran the same eight automated checks on 13,739 MCP servers, skills and plugins. The most common findings are small ones about how code is written, such as a mention of a .env file. They are not proof that anything is being misused.

Figures: 13,739 entries graded between 16/10/2026 and 25/10/2026, a snapshot taken on 25/10/2026; the directory has since grown (14,739 entries on 26/10/2026). Graded under Rubric v2. The directory is a selected set of tools, not a census of the whole ecosystem, so these numbers describe the tools we have graded, not every tool that exists.

What the checks find most often

Every tool gets the same eight checks, and each finding has a level: Note, Low, Medium, High. Across the directory, 11,400 of 13,739 tools (83.0%) have at least one finding. These are the four most common, counted once per tool:

1. A network call whose host is not written as a fixed address. 4,534 tools (33.0%). Level: Low. The tool talks to an address the code works out at run time, so we cannot say where it goes from the text alone.
2. A mention of a .env file. 3,727 tools (27.1%). Level: Low. A mention is not a leaked secret. It tells you the tool expects to read local settings, so check what it reads.
3. Reading an environment variable named like KEY, SECRET, TOKEN, PASSWORD or CREDENTIAL. 1,834 tools (13.3%). Level: Note, the mildest. Many tools need an API key and read it this way.
4. A mention of a credential store path such as ~/.ssh or .npmrc. 1,267 tools (9.2%). Level: Medium, the most common finding at that level.

The first three are Low or Note. They are mostly about how code is written. They are worth a glance before you install, but they are not evidence of a problem. Each finding's wording is the site's own text. See How we grade.

If you maintain a tool: writing hosts as fixed addresses where you can, and saying in the description what your tool reads and calls, can remove some of these findings.

The grade mix

Here is how the 13,739 tools split:

• A, No issues found: 2,339 tools (17.0%).
• B, Minor notes only: 7,432 tools (54.1%).
• C, One medium finding: 2,905 tools (21.1%).
• D, Two or more medium findings, or a high: 1,063 tools (7.7%).
• F, Pattern found, check before installing: none published.

"No issues found" means no findings from our checks. It is not a guarantee.

A D grade means a tool failed automated checks: two or more Medium findings, or a High. About two thirds of D grades come from two Medium findings and no High. Rubric v2 on 20/10/2026 already moved a group of tools that had been D for lower level findings up to B (see the changelog). We name no D grade in this post.

No F grade has been published. F grades are held back for me to check before release.

One comparison

MCP servers get "No issues found" less often than Claude Code skills: 12.6% of 7,705 servers, against 21.8% of 3,383 skills. Both groups are large. We have not compared other grades between types, because the gaps are small enough that we would not want to read much into them.

What these grades do not mean

• They are automated hygiene checks of the source at one commit, on the date shown. They are not a security audit, and not proof that a tool is safe or that it contains a vulnerability.
• The checks read static text. They do not run the tool, and they cannot see downloads fetched later or what a tool does while it runs.
• Grades describe the code at the date shown. A later change is not covered.

Check a tool, or challenge a grade

• Check your own tool to see its grade and the reasons.
• Think a grade is wrong? See how to appeal. Email [email protected] with the entry link and your evidence. We aim to acknowledge within two working days and decide within seven. If we confirm an error, we aim to correct it within 24 hours of confirming it. These are aims, not guarantees.